Skip to main content

What is Verdaccio?

Verdaccio is a lightweight private npm proxy registry built in Node.js

Using a private npm registry like Verdaccio is one of the Top 10 NPM Security Best Practices recommended by the Open Web Application Security Project (OWASP).

What's a registry?​

  • A registry is a repository for packages, that implements the CommonJS Compliant Package Registry specification for reading package's information.
  • Provide a compatible API with npm clients (yarn/npm/pnpm).
  • Semantic Versioning compatible (semver).
$> verdaccio
verdaccio — running on :4873$ verdaccioinfo --- http address http://localhost:4873/http --> 200, req: 'GET https://registry.npmjs.org/arr-union' (streaming)http <-- 200, user: undefined(127.0.0.1), req: 'GET /arr-union/-/arr-union-3.1.0.tgz', bytes: 0/3013http --> 200, req: 'GET https://registry.npmjs.org/static-extend' (streaming)http <-- 200, user: undefined(127.0.0.1), req: 'GET /static-extend/-/static-extend-0.1.2.tgz', bytes: 0/2377http --> 200, req: 'GET https://registry.npmjs.org/is-descriptor' (streaming)http <-- 200, user: undefined(127.0.0.1), req: 'GET /is-descriptor/-/is-descriptor-0.1.6.tgz', bytes: 0/4275http --> 200, req: 'GET https://registry.npmjs.org/kind-of' (streaming)http <-- 200, user: undefined(127.0.0.1), req: 'GET /kind-of/-/kind-of-5.1.0.tgz', bytes: 0/5747

Using Verdaccio​

Using Verdaccio with any Node.js package manager client is quite straightforward.

my-app — zsh$ pnpm add lodash --registry http://localhost:4873Progress: resolved 1, reused 0, downloaded 0, added 0Progress: resolved 1, reused 0, downloaded 1, added 1, donedependencies:+ lodash 4.17.21Done in 1.3s

You can use a custom registry either by setting it globally for all your projects

npm set registry http://localhost:4873

or by using it in command line as an argument --registry in npm (slightly different in yarn)

npm install lodash --registry http://localhost:4873
yarn config set registry http://localhost:4873

For a more detailed walkthrough, watch Angular Library: Private NPM Package in Angular Using Verdaccio on the Video Talks page.

Private​

All packages that you publish are private and only accessible based in your configuration.

Proxy​

Verdaccio cache all dependencies on demand and speed up installations in local or private networks.

In a Nutshell​

  • It's a web app based on Node.js
  • It's a private npm registry
  • It's a local network proxy
  • It's a Pluggable application
  • It's fairly easy to install and to use
  • We offer Docker and Kubernetes support
  • It is 100% compatible with yarn, npm and pnpm
  • Verdaccio means A green color popular in late medieval Italy for fresco painting.