diff --git a/composite-actions/nodejs-generic-api/test-unit/action.yaml b/composite-actions/nodejs-generic-api/test-unit/action.yaml
index 87982642..70df36fb 100644
--- a/composite-actions/nodejs-generic-api/test-unit/action.yaml
+++ b/composite-actions/nodejs-generic-api/test-unit/action.yaml
@@ -107,6 +107,25 @@ runs:
       shell: bash
       run: npm run test:cov
 
+    - name: Run NPM auth script
+      shell: bash
+      run: |
+        if [ ! -f ".npmrc" ]; then
+          echo "Missing .npmrc in repository root."
+          echo "Please commit .npmrc with private registry mapping."
+          echo "Example: @hiiretail:registry=https://europe-west1-npm.pkg.dev/extenda/npm/"
+          exit 1
+        fi
+
+        if ! npm run | grep -Eq '^[[:space:]]+auth$'; then
+          echo "Missing npm auth script in package.json."
+          echo "Please add an auth script, for example:"
+          echo "\"auth\": \"npx --yes google-artifactregistry-auth\""
+          exit 1
+        fi
+
+        npm run auth -- --credential-config=./.npmrc
+
     - name: Build vulnerability scan image
       id: scan-image
       shell: bash
@@ -125,9 +144,9 @@ runs:
         fi
 
         echo "Building local image for vulnerability scan: $IMAGE"
-        if ! docker build --quiet -t "$IMAGE" .; then
+        if ! docker build --quiet -t "$IMAGE"  .; then
           echo "Initial quiet Docker build failed. Retrying with full logs for debugging..."
-          docker build -t "$IMAGE" .
+          docker build -t "$IMAGE" . 
           echo "Failed to build image $IMAGE."
           exit 1
         fi
@@ -157,4 +176,4 @@ runs:
           *Unit test failed for ${{ github.repository }}: ${{ github.workflow }}* :heavy_exclamation_mark:
           Test failed on ${{ github.event_name }} event. Workflow: ${{ github.workflow }}. Job: ${{github.job}}. Run id: <https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.run_id }}>
         channel: ${{ inputs.slack-channel }}
-        service-account-key: ${{ inputs.GCLOUD_AUTH || inputs.SECRET_AUTH }}
\ No newline at end of file
+        service-account-key: ${{ inputs.GCLOUD_AUTH || inputs.SECRET_AUTH }}