Skip to content
SPECIFICTION
Get listed

Verdaccio

verdaccio.org

Free plan WebLinuxAPISelf-hosted
Visit verdaccio.org
Spec score 7.3 #54 of 64 in Artifact repository software

What it is

Verdaccio is a lightweight Node.js private proxy registry for organizations managing npm packages. It keeps private packages away from public registries, proxies sources such as npmjs.org, and caches downloaded modules. Multiple registries can be chained behind one endpoint, and teams can publish modified third-party packages locally under their existing names. npm, yarn, and pnpm clients are supported. Verdaccio can run self-hosted, with an official Docker image and Kubernetes Helm support. Its default storage uses the local file system and a small built-in database. Built-in htpasswd authentication and package access rules govern access, publishing, and unpublishing. JWT tokens may be configured with expiration, while legacy tokens are not designed to expire. Plugins extend authentication, middleware, storage, UI themes, and filtering. Installation requires Node.js, a package manager, and a modern browser; version 6.x requires Node.js 22 or later, and 7.x requires Node.js 24 or later.

Spec sheet

Product
Verdaccio is a lightweight Node.js private proxy registry.Read 4 Oct 2026 · verdaccio.org
Deployment
Verdaccio provides an official Docker image and Kubernetes Helm support.Read 4 Oct 2026 · verdaccio.org
Authentication and access
Built-in htpasswd authentication is the default, and package access rules can control access, publishing and unpublishing.Read 4 Oct 2026 · verdaccio.org
Clients
The site says popular npm clients are supported, including npm, yarn and pnpm.Read 4 Oct 2026 · verdaccio.org
Community support
The site links to a community Discord server.Read 4 Oct 2026 · verdaccio.org
Extensions
Verdaccio supports authentication, middleware, storage, UI theme and filter plugins.Read 4 Oct 2026 · verdaccio.org
Package override
Users can publish a modified version of a third-party package locally under the same name.Read 4 Oct 2026 · verdaccio.org
Private packages
It lets organizations use private npm packages without sending their code to the public.Read 4 Oct 2026 · verdaccio.org
Proxy and cache
It can proxy other registries such as npmjs.org and cache downloaded modules.Read 4 Oct 2026 · verdaccio.org
Registry chaining
It can chain multiple registries so projects fetch packages from one endpoint.Read 4 Oct 2026 · verdaccio.org
Requirements
The installation page lists Node.js, a package manager and a modern browser as prerequisites; Verdaccio 6.x requires Node.js 22 or later and 7.x requires Node.js 24 or later.Read 4 Oct 2026 · verdaccio.org
Storage
By default, Verdaccio uses the local file system and a small built-in database for private packages.Read 4 Oct 2026 · verdaccio.org
Token security
JWT tokens can be configured with expiration; the documentation says legacy tokens are not designed to expire.Read 4 Oct 2026 · verdaccio.org

Plans and prices

Verdaccio Free No paid plans or price stated on the opened official pages Read 4 Oct 2026 · verdaccio.org

Every Verdaccio plan and price →

Strong points and limits

Strong points

  • Keeps private packages out of public registries
  • Caches modules from upstream registries
  • Supports npm, yarn, and pnpm
  • Fine-grained package access rules
  • Docker image and Kubernetes Helm support

Limits

  • Requires Node.js and a package manager
  • Node.js version requirements vary by release
  • Legacy tokens are not designed to expire
  • Self-hosting requires operational responsibility

Who it suits

Verdaccio suits organizations that need self-hosted private npm distribution, upstream caching, and controlled package access. It fits teams using npm, yarn, or pnpm with Docker or Kubernetes deployment options.

Verdict

Verdaccio combines private package hosting, upstream proxying, and access controls in a free open-source registry. Its Node.js prerequisites and self-hosted deployment model should be considered before adoption.

Where Specifiction places it

Alternatives to VerdaccioAll alternatives →