Freedom251 › Artifact repository software
Verdaccio
What Verdaccio is
Verdaccio is a free, open-source private proxy registry for Node.js packages. Organizations can keep private npm packages within their own setup, proxy registries such as npmjs.org, and cache modules downloaded from them. It can connect multiple registries behind one endpoint, giving projects a single place to fetch packages. Teams can also publish a locally modified third-party package under its existing name.
Verdaccio supports npm, yarn, and pnpm clients and can be self-hosted. The project provides an official Docker image and Kubernetes Helm support. Its default storage uses the local file system and a small built-in database for private packages. Built-in htpasswd authentication and package access rules govern who can access, publish, or unpublish packages. JWT tokens can be configured with expiration; legacy tokens are not designed to expire.
Plugins can add authentication, middleware, storage, UI themes, and filtering. Installation prerequisites include Node.js, a package manager, and a modern browser. Verdaccio 6.x requires Node.js 22 or later, while 7.x requires Node.js 24 or later. The site links to a community Discord server.
Who it suits
Verdaccio suits organizations that need a private npm package registry and want projects to fetch packages through a shared endpoint. It is also relevant to teams that need package access rules, registry caching, or self-hosted deployment.
What it does well
- Free and open source.
- Caches modules from proxied registries.
- Chains multiple registries behind one endpoint.
- Supports npm, yarn, and pnpm.
- Offers package access rules and plugin extensions.
What to know first
- Requires Node.js, a package manager, and a modern browser.
- Version 6.x requires Node.js 22 or later; 7.x requires Node.js 24 or later.
- Legacy tokens are not designed to expire.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Verdaccio | No paid plans or price stated on the opened official pages | Free |
As verdaccio.org lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Verdaccio website.
- Prepare Node.js, a package manager, and a modern browser.
- Choose a deployment route, such as the official Docker image or Kubernetes Helm support.
- Set up authentication and package access rules for your registry.
- Connect npm, yarn, or pnpm to the registry endpoint.
Verdict
Choose Verdaccio if you need a free, self-hosted registry for private Node.js packages, registry proxying, and package access rules. Check the Node.js requirement for your intended version, and account for the fact that legacy tokens are not designed to expire.
Questions
Is Verdaccio free?
Yes. Verdaccio is open source and the listed plan is free.
Can Verdaccio keep packages private?
Yes. Organizations can use private npm packages without sending their code to the public, with package access rules to control access and publishing.
Which package clients does it support?
The site says popular npm clients are supported, including npm, yarn, and pnpm.
Can it proxy and cache other registries?
Yes. It can proxy registries such as npmjs.org and cache downloaded modules.
What does Verdaccio require?
The installation prerequisites include Node.js, a package manager, and a modern browser. Verdaccio 6.x requires Node.js 22 or later, and 7.x requires Node.js 24 or later.
How does authentication work?
Built-in htpasswd authentication is the default. JWT tokens can be configured with expiration, while legacy tokens are not designed to expire.
Facts from Verdaccio's own pages
- Authentication and access
- Built-in htpasswd authentication is the default, and package access rules can control access, publishing and unpublishing. · verdaccio.org, 4 Oct 2026
- Clients
- The site says popular npm clients are supported, including npm, yarn and pnpm. · verdaccio.org, 4 Oct 2026
- Community support
- The site links to a community Discord server. · verdaccio.org, 4 Oct 2026
- Deployment
- Verdaccio provides an official Docker image and Kubernetes Helm support. · verdaccio.org, 4 Oct 2026
- Extensions
- Verdaccio supports authentication, middleware, storage, UI theme and filter plugins. · verdaccio.org, 4 Oct 2026
- Package override
- Users can publish a modified version of a third-party package locally under the same name. · verdaccio.org, 4 Oct 2026
- Private packages
- It lets organizations use private npm packages without sending their code to the public. · verdaccio.org, 4 Oct 2026
- Product
- Verdaccio is a lightweight Node.js private proxy registry. · verdaccio.org, 4 Oct 2026
- Proxy and cache
- It can proxy other registries such as npmjs.org and cache downloaded modules. · verdaccio.org, 4 Oct 2026
- Registry chaining
- It can chain multiple registries so projects fetch packages from one endpoint. · verdaccio.org, 4 Oct 2026
- Requirements
- The installation page lists Node.js, a package manager and a modern browser as prerequisites; Verdaccio 6.x requires Node.js 22 or later and 7.x requires Node.js 24 or later. · verdaccio.org, 4 Oct 2026
- Storage
- By default, Verdaccio uses the local file system and a small built-in database for private packages. · verdaccio.org, 4 Oct 2026
- Token security
- JWT tokens can be configured with expiration; the documentation says legacy tokens are not designed to expire. · verdaccio.org, 4 Oct 2026
Where Verdaccio stands on Freedom251
- Artifact repository software#44 of 64
- Package Registries#20 of 28