- Home
- Artifact repository software
- Verdaccio
Verdaccio
What it is
Verdaccio is a free, open-source Node.js private proxy registry for organizations using private npm packages without sending code to a public registry. It can proxy registries such as npmjs.org, cache downloaded modules, and chain multiple registries behind one endpoint. Teams may publish a modified third-party package locally under the same name. Popular clients including npm, yarn, and pnpm are supported. Verdaccio can be self-hosted on Linux, with an official Docker image and Kubernetes Helm support. By default, private packages use local file-system storage and a small built-in database. Built-in htpasswd authentication and package access rules govern access, publishing, and unpublishing. JWT tokens can be configured with expiration, while legacy tokens are not designed to expire. Plugins extend authentication, middleware, storage, UI themes, and filtering. Installation requires Node.js, a package manager, and a modern browser; Verdaccio 6.x requires Node.js 22 or later, while 7.x requires Node.js 24 or later.
For and against
For
- Free open-source licensing
- Caches modules from upstream registries
- Fine-grained package access rules
- Official Docker and Kubernetes Helm support
- Supports npm, yarn, and pnpm clients
Against
- Requires self-hosting and local setup
- Node.js version requirements vary by major release
- Legacy JWT tokens are not designed to expire
The verdict
Verdaccio provides a focused private registry with proxying, caching, access controls, and extensibility. Teams must handle hosting and prerequisites themselves, but the software has no listed paid plan.
Who it suits
It suits development teams that need self-hosted private npm package storage, upstream proxying, and controlled package access. Projects using npm, yarn, or pnpm can connect through the registry.
Plans and prices
Verdaccio
No paid plans or price stated on the opened official pages
Read 4 Oct 2026 · verdaccio.org
On the record
- Authentication and access
- Built-in htpasswd authentication is the default, and package access rules can control access, publishing and unpublishing.verdaccio.org · read 4 Oct 2026
- Clients
- The site says popular npm clients are supported, including npm, yarn and pnpm.verdaccio.org · read 4 Oct 2026
- Community support
- The site links to a community Discord server.verdaccio.org · read 4 Oct 2026
- Deployment
- Verdaccio provides an official Docker image and Kubernetes Helm support.verdaccio.org · read 4 Oct 2026
- Extensions
- Verdaccio supports authentication, middleware, storage, UI theme and filter plugins.verdaccio.org · read 4 Oct 2026
- Package override
- Users can publish a modified version of a third-party package locally under the same name.verdaccio.org · read 4 Oct 2026
- Private packages
- It lets organizations use private npm packages without sending their code to the public.verdaccio.org · read 4 Oct 2026
- Product
- Verdaccio is a lightweight Node.js private proxy registry.verdaccio.org · read 4 Oct 2026
- Proxy and cache
- It can proxy other registries such as npmjs.org and cache downloaded modules.verdaccio.org · read 4 Oct 2026
- Registry chaining
- It can chain multiple registries so projects fetch packages from one endpoint.verdaccio.org · read 4 Oct 2026
- Requirements
- The installation page lists Node.js, a package manager and a modern browser as prerequisites; Verdaccio 6.x requires Node.js 22 or later and 7.x requires Node.js 24 or later.verdaccio.org · read 4 Oct 2026
- Storage
- By default, Verdaccio uses the local file system and a small built-in database for private packages.verdaccio.org · read 4 Oct 2026
- Token security
- JWT tokens can be configured with expiration; the documentation says legacy tokens are not designed to expire.verdaccio.org · read 4 Oct 2026
