Home / verdaccio / verdaccio
Repository Analysis

verdaccio/verdaccio

A lightweight Node.js private proxy registry

1.0 Likely human-written View on GitHub
1.0
Adjusted Score
1.0
Raw Score
100%
Time Factor
2026-05-29
Last Push
17,676
Stars
TypeScript
Language
213,692
Lines of Code
1370
Files
178
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 0HIGH 0MEDIUM 16LOW 162

Pattern Findings

178 matches across 7 categories. Click a row to expand file-level details.

Over-Commented Block105 hits · 101 pts
SeverityFileLineSnippet
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml1#
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml21 docker-memory:
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml41 # In combination with darkMode you can force specific theme
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml101# To improve your security configuration and avoid dependency confusion
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml121# VERDACCIO_PUBLIC_URL='https://fake.verdaccio.org';
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml141# someProp: [value]
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml161# https://verdaccio.org/docs/configuration#https
LOW…er-examples/v6/plugins/docker-local-plugin/docker.yaml181
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml1#
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml21# https://verdaccio.org/docs/webui
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml41 # HTML tags injected after manifest <scripts/>
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml101# https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml121# // url -> https://fake.verdaccio.org/
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml141# https://verdaccio.org/docs/configuration#user-rate-limit
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml161# key: ./path/verdaccio-key.pem
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml181 user: systemUser
LOW…les/v6/plugins/docker-build-install-plugin/docker.yaml201# translate your registry, api i18n not available yet
LOW…amples/v6/docker-local-storage-volume/conf/config.yaml1#
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml1#
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml21 docker-memory:
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml41 # In combination with darkMode you can force specific theme
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml101# To improve your security configuration and avoid dependency confusion
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml121# VERDACCIO_PUBLIC_URL='https://fake.verdaccio.org';
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml141# someProp: [value]
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml161# https://verdaccio.org/docs/configuration#https
LOW…er-examples/v5/plugins/docker-local-plugin/docker.yaml181
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml1#
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml21# https://verdaccio.org/docs/webui
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml41 # HTML tags injected after manifest <scripts/>
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml101# https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml121# // url -> https://fake.verdaccio.org/
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml141# https://verdaccio.org/docs/configuration#user-rate-limit
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml161# key: ./path/verdaccio-key.pem
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml181 user: systemUser
LOW…les/v5/plugins/docker-build-install-plugin/docker.yaml201# translate your registry, api i18n not available yet
LOWscripts/e2e-ui-local.sh1#!/usr/bin/env bash
LOWscripts/e2e-cli-local.sh1#!/usr/bin/env bash
LOWpackages/proxy/test/proxy.search.spec.ts101 // const mockAgent = new MockAgent({ connections: 1 });
LOWpackages/config/src/conf/docker.yaml1#
LOWpackages/config/src/conf/docker.yaml21web:
LOWpackages/config/src/conf/docker.yaml41 # showSettings: true
LOWpackages/config/src/conf/docker.yaml61 # HTML tags injected as last child in </body>
LOWpackages/config/src/conf/docker.yaml101
LOWpackages/config/src/conf/docker.yaml121 # 'deny' returns 403, 'ignore' returns 404 (default), 'allow' passes through.
LOWpackages/config/src/conf/docker.yaml141
LOWpackages/config/src/conf/docker.yaml161# security:
LOWpackages/config/src/conf/docker.yaml181# max_body_size: 10mb
LOWpackages/config/src/conf/docker.yaml201# https_proxy: https://something.local/
LOWpackages/config/src/conf/docker.yaml221 '@verdaccio/package-filter':
LOWpackages/config/src/conf/docker.yaml241# Synchronous logging: https://getpino.io/#/docs/asynchronous
LOWpackages/config/src/conf/docker.yaml261# tarball_url_redirect(packageName, filename) {
LOWpackages/config/src/conf/default.yaml1#
LOWpackages/config/src/conf/default.yaml21web:
LOWpackages/config/src/conf/default.yaml41 # showSettings: true
LOWpackages/config/src/conf/default.yaml61 # HTML tags injected as last child in </body>
LOWpackages/config/src/conf/default.yaml101 #
LOWpackages/config/src/conf/default.yaml121# WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issu
LOWpackages/config/src/conf/default.yaml141# publish:
LOWpackages/config/src/conf/default.yaml161# // url -> https://somedomain.org/second_prefix/
LOWpackages/config/src/conf/default.yaml181# windowMs: 50000
45 more matches not shown…
AI Slop Vocabulary15 hits · 45 pts
SeverityFileLineSnippet
MEDIUM…er-examples/v6/plugins/docker-local-plugin/docker.yaml3# please read carefully the documentation and best practices to
MEDIUM…er-examples/v6/plugins/docker-local-plugin/docker.yaml13# Read about the best practices
MEDIUM…les/v6/plugins/docker-build-install-plugin/docker.yaml3# please read carefully the documentation and best practices to
MEDIUM…les/v6/plugins/docker-build-install-plugin/docker.yaml13# Read about the best practices
MEDIUM…er-examples/v5/plugins/docker-local-plugin/docker.yaml3# please read carefully the documentation and best practices to
MEDIUM…er-examples/v5/plugins/docker-local-plugin/docker.yaml13# Read about the best practices
MEDIUM…les/v5/plugins/docker-build-install-plugin/docker.yaml3# please read carefully the documentation and best practices to
MEDIUM…les/v5/plugins/docker-build-install-plugin/docker.yaml13# Read about the best practices
MEDIUMpackages/config/src/conf/docker.yaml3# please read carefully the documentation and best practices to
MEDIUMpackages/config/src/conf/docker.yaml9# Read about the best practices
MEDIUMpackages/config/src/conf/default.yaml3# please read carefully the documentation and best practices to
MEDIUMpackages/config/src/conf/default.yaml9# Read about the best practices
MEDIUMpackages/web/test/config/protected-package.yaml24 # to facilitate the test we allow anonymous publish
MEDIUMpackages/verdaccio/test/config.yaml3# please read carefully the documentation and best practices to
MEDIUMpackages/verdaccio/test/config.yaml9# Read about the best practices
Fake / Example Data24 hits · 35 pts
SeverityFileLineSnippet
LOW…es/ui-components/src/components/Person/Person.test.tsx8 name: 'John Doe',
LOWpackages/search/test/search.test.ts60 email: 'test@test.com',
LOWpackages/search/test/search.test.ts65 email: 'test@test.com',
LOWpackages/search/test/search.test.ts70 email: 'test@test.com',
LOWpackages/search/test/search.test.ts74 email: 'test@test.com',
LOWpackages/search/test/search.test.ts78 email: 'test@test.com',
LOWpackages/search/test/search.test.ts82 email: 'test@test.com',
LOWpackages/search/test/search.test.ts86 email: 'test@test.com',
LOWpackages/search/test/search.test.ts90 email: 'test@test.com',
LOWpackages/search/test/partials/search.json29 "email": "test@test.com",
LOWpackages/search/test/partials/search.json32 "publisher": { "username": "verdaccio.npm", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json34 { "username": "jotadeveloper", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json35 { "username": "ayusharma", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json36 { "username": "trentearl", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json37 { "username": "jmwilkinson", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json38 { "username": "sergiohgz", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json39 { "username": "verdaccio.npm", "email": "test@test.com" }
LOWpackages/search/test/partials/search.json69 "email": "test@test.com",
LOWpackages/search/test/partials/search.json72 "publisher": { "username": "verdaccio.npm", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json74 { "username": "sergiohgz", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json75 { "username": "verdaccio.npm", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json76 { "username": "jotadeveloper", "email": "test@test.com" },
LOWpackages/search/test/partials/search.json77 { "username": "ayusharma", "email": "test@test.com" }
LOWpackages/search/test/partials/search.json132 "author": { "name": "Verdaccio Core Team", "email": "test@test.com" },
Hyper-Verbose Identifiers30 hits · 32 pts
SeverityFileLineSnippet
LOWscripts/global-install.js34function discoverWorkspacePackages() {
LOW…/tools/helpers/src/generateUnPublishPackageMetadata.ts3export function generateUnPublishPackageMetadata(
LOW…tools/helpers/src/generatePublishNewVersionManifest.ts18export function generatePublishNewVersionManifest(
LOW…ages/tools/helpers/src/generateLocalPackageMetadata.ts5export function generateLocalPackageMetadata(
LOW…ges/tools/helpers/src/generateRemotePackageMetadata.ts5export function generateRemotePackageMetadata(
LOW…ages/tools/helpers/src/getDeprecatedPackageMetadata.ts6export function getDeprecatedPackageMetadata(
LOWpackages/core/core/src/tarball-utils.ts37export function composeTarballFromPackage(name: string, version: string): string {
LOWpackages/core/core/src/string-utils.ts8export function getByQualityPriorityValue(headerValue: string | undefined | null): string {
LOWpackages/core/core/src/schemes/unpublish-manifest.ts65export function validateUnPublishSingleVersion(manifest: any) {
LOWpackages/core/core/src/schemes/publish-manifest.ts34export function validatePublishSingleVersion(manifest: any) {
LOW…ore/tarball/src/convertDistRemoteToLocalTarballUrls.ts13export function convertDistRemoteToLocalTarballUrls(
LOW…ore/tarball/src/convertDistRemoteToLocalTarballUrls.ts47export function convertDistVersionToLocalTarballsUrl(
LOWpackages/core/tarball/src/getLocalRegistryTarballUri.ts14export function getLocalRegistryTarballUri(
LOWpackages/proxy/src/uplink-util.ts25export function updateVersionsHiddenUpLinkNext(manifest: Manifest, upLink: IProxy): Manifest {
LOWpackages/config/src/user.ts47export function createAnonymousRemoteUser(): RemoteUser {
LOW…es/plugins/package-filter/src/filtering/publishDate.ts14export function filterVersionsByPublishDate(
LOWpackages/ui-components/src/utils/utils.ts74export function getLastUpdatedPackageTime(uplinks: UpLinks = {}): string {
LOWpackages/ui-components/src/utils/token-generate.ts10export function generateTokenWithTimeRange(amount = 0) {
LOWpackages/ui-components/src/utils/token-generate.ts18export function generateTokenWithExpirationAsString() {
LOWpackages/ui-components/src/utils/token-generate.ts28export function generateTokenWithOutExpiration() {
LOWpackages/ui-components/src/components/Help/Help.tsx11function renderHeadingClipboardSegments(title: string, text: string): React.ReactNode {
LOWpackages/verdaccio/test/disabled_test/__helper/api.ts186export async function fetchPackageByVersionAndTag(
LOWpackages/verdaccio/test/disabled_test/__helper/api.ts208export async function verifyPackageVersionDoesExist(app, packageName, version, token?: string) {
LOW…kages/verdaccio/test/disabled_test/__helper/expects.ts6export function getTaggedVersionFromPackage(pkg, pkgName, tag: string = LATEST, version: string) {
LOWpackages/node-api/src/experiments.ts3export function displayExperimentsInfoBox(flags) {
LOW…/partials/test-plugin-storage/verdaccio-scope/index.js1function ValidScopedVerdaccioPlugin() {
LOW…gin-storage/@verdaccio-scope/verdaccio-plugin/index.js1function ValidScopedVerdaccioPlugin() {
LOWpackages/store/src/lib/versions-utils.ts43export function sortVersionsAndFilterInvalid(listVersions: string[] /* logger */): string[] {
LOWpackages/store/src/lib/storage-utils.ts206export function mergeUplinkTimeIntoLocalNext(
LOWpackages/store/src/lib/storage-utils.ts379export function mapManifestToSearchPackageBody(
Example Usage Blocks2 hits · 3 pts
SeverityFileLineSnippet
LOWscripts/e2e-ui-local.sh8# Usage:
LOWscripts/e2e-cli-local.sh4# Usage:
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippet
MEDIUMpackages/ui-components/vitest/api/jquery-readme.js1export default '# jQuery\n\n> jQuery is a fast, small, and feature-rich JavaScript library.\n\nFor information on how to
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippet
LOWpackages/ui-components/public/mockServiceWorker.js120async function handleRequest(event, requestId, requestInterceptedAt) {