3,336 Verdaccio Private npm Registries Exposed Online, Study Finds

A ZoomEye search using the query title="Verdaccio" has identified 3,336 publicly indexed hosts running Verdaccio, a lightweight private npm registry used by development teams to host internal packages and cache public dependencies. Researchers warn that exposed registries can leak sensitive internal packages, which often contain endpoint names, credentials, and configuration data committed before secret-scanning tools were in place. Write access to such registries poses a supply chain risk, as a malicious actor could publish tampered versions of packages that other teams depend on. Many exposures stem from misconfigured deployments, default container port settings, or abandoned registries left running after projects ended. Security experts recommend that organisations audit external accessibility, review token scopes, check for plaintext uplink credentials, and ensure registries are updated with the latest security patches.