81,570 Nexus Titles Against 33,873 Fingerprints: The Artefact Store Everything Builds From

81,570 Nexus Repository titles were found in comparison to 33,873 fingerprint matches, representing a 141% gap between the two metrics. The Artefact Store, which serves as the foundation for every deployment pipeline within an organization, holds internal libraries, container images, and release packages that other systems trust without verification. Due to its critical role, it has become a potential chokepoint in the supply chain, necessitating a closer examination of its internet exposure.

Using the ZoomEye index, data was collected on October 23, 2026, focusing on Nexus Repository titles. The title query yielded 81,570 matches, while the fingerprint query only found 33,873 matches. The discrepancy between these numbers could be attributed to variations in wording or structural differences, as the application fingerprint string and title string are not identical tokens. Additionally, repositories protected by a proxy might display the product title while failing the stricter fingerprint rule.

Nexus Repository serves three functions simultaneously: caching upstream registries, hosting internal releases, and acting as an authentication boundary that decides who may publish. The third function is where risk concentration occurs, as publishing to an internal repository is a code execution primitive in every organization that uses it. An attacker who can push a version of an internal library that other projects depend on does not require compromising a build server; they merely need to become the build's input.

Read access to a repository also poses risks, as it provides attackers with internal package names, version histories, and often the naming convention that reveals which team owns which component. This reconnaissance is more effective than external scanning methods. The version question is further complicated by Nexus Repository's history of authentication and path traversal issues across various versions.

A fingerprint match indicates that the product responded, but it does not specify which release is running or whether anonymous access is permitted.

To address these concerns, it is recommended to query both strings against your own address space and reconcile the difference. If the title count exceeds the fingerprint count, some repositories may be behind proxies, and the inventory should account for this. For each match, determine whether anonymous browse is enabled, as this single setting determines whether the index entry is informational or actionable.

Additionally, enumerate repositories that accept unauthenticated publish, as this is rare but catastrophic. Confirm that the host does not serve the admin interface on the same listener as the proxy endpoint, as separating them is the cheapest available mitigation and is often overlooked. Lastly, record the version each instance reports and compare it against the vendor's current release rather than relying on advisory summaries.