Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out

Verdaccio, a lightweight private registry for npm packages, is found on 3,336 hosts according to a ZoomEye title query. Private registries offer two forms of value: they expose internal packages and hold metadata about them, and they serve as a supply chain position where a user can influence the dependencies of other teams. Verdaccio can also act as a caching proxy, storing credentials used to fetch from upstream and potentially allowing those credentials to be transmitted.

Many instances of Verdaccio end up in public indexes due to three common patterns: speed up builds across several offices, exposed registry port by default in container or CI images, and running registries after the projects they fed were retired. To secure a Verdaccio instance, five checks are recommended: verifying the registry address resolves from outside the build network, checking anonymous access settings, reviewing tokens and their scopes, inspecting uplink credentials storage, and ensuring the registry is running a supported release with the latest security fixes.

A title query provides a snapshot of the population, which can be narrowed down with a hosting provider filter. However, the query does not provide information about authentication settings, token scopes, or package contents, so it should not be used to make claims about specific deployments.