Skip to main content
protocols.pageprotocols.page
8083

Port 8083 – Verdaccio / npm Proxy

TCP

Port 8083 is the default port for Verdaccio (private npm registry) and various HTTP proxy services. Verdaccio on port 8083 caches npm packages and hosts private packages. Exposed instances may leak private package source code. Restrict access and enable authentication for private registries.

Port Number

8083

Protocol

TCP

Service

npm Private Registry

Range

IANA Registered (1024–49151)

Description

Verdaccio private npm registry defaults to port 8083, providing organizations with a local npm cache and private package hosting. It proxies requests to the public npmjs.com registry for packages it does not host locally, caching them for faster subsequent installs. An exposed Verdaccio instance on port 8083 without authentication allows anyone to publish packages (potentially overriding internal packages with malicious versions) and download private source code. Always enable authentication (htpasswd or LDAP), restrict publish access to specific users/groups, and bind to internal networks only.

Security risks

  • 1Dependency confusion / typosquatting: an unauthenticated Verdaccio instance allows attackers to publish packages with names matching internal private packages. When developers run npm install, the malicious version executes install scripts with full system access (CVE-2021-23566 in npm's scope resolution).
  • 2Private source code exfiltration: exposed Verdaccio on port 8083 without auth lets any client npm pack or download every hosted tarball – leaking proprietary business logic, API keys embedded in source, and internal service architecture.
  • 3Supply chain poisoning via publish access: attackers publish a higher-version package with the same name as a legitimate internal package. npm resolves the higher version from Verdaccio, executing attacker-controlled preinstall/postinstall scripts on CI runners and developer machines.
  • 4Token leakage in .npmrc: developers often store Verdaccio auth tokens in ~/.npmrc or project-level .npmrc. Committing these to Git exposes publish credentials. Rotate tokens regularly and use short-lived CI tokens.

Firewall guidance

Bind Verdaccio to internal networks only (listen: 127.0.0.1:8083 or a private subnet). Enable htpasswd or LDAP authentication in config.yaml. Set max_users: -1 to disable self-registration. Use packages.$pkg.access and packages.$pkg.publish scopes to restrict who can read/write each package scope. Place behind nginx with TLS for any cross-network access.

Diagnosis commands

List all hosted packages (should require auth)

shell
curl -s http://localhost:8083/-/verdaccio/packages | jq '.[].name'

Test if anonymous access is allowed (should fail with 401)

shell
npm whoami --registry http://localhost:8083

Verdaccio health check endpoint

shell
curl -s http://localhost:8083/-/ping

Check hosted packages for known vulnerabilities

shell
npm audit --registry http://localhost:8083

Usage examples

Port 8083 – Verdaccio / npm Proxy
shell
verdaccio --listen 8083
npm set registry http://localhost:8083/
npm publish --registry http://registry:8083

Common services on this port

VerdaccioSinopia (predecessor)Nexus Repository npm proxyArtifactory npm registryGitHub Packages

Related ports

8080

HTTP alternate (proxy conflicts)

4873

Verdaccio alternate default

443

npmjs.com upstream registry

History

Verdaccio is a fork of Sinopia (abandoned 2015), rewritten and maintained by the community. Port 4873 was Sinopia's default; Verdaccio documentation often shows 4873 but many deployments use 8083 to align with other HTTP service conventions. Verdaccio 5.x (2021) added plugin-based authentication, storage backends (S3, GCS), and improved security defaults including mandatory auth for publish operations.

FAQ

How do I prevent dependency confusion attacks with Verdaccio?

Configure uplinks with strict filtering: only proxy packages that don't exist locally. Set packages '@myorg/*': { access: '$authenticated', publish: 'admin', proxy: '' } (empty proxy = never fetch from upstream for scoped packages). This ensures @myorg/ packages can only come from your registry, never from npmjs.com. Additionally, claim your scope on npmjs.com even if you don't publish there.

Should I use Verdaccio or a managed registry (Artifactory, GitHub Packages)?

Verdaccio: free, self-hosted, simple (single config.yaml), great for caching npm in CI (reduces npmjs.com bandwidth), lightweight for small teams. Managed: better for enterprises needing audit trails, vulnerability scanning, license compliance, multi-format support (Maven + npm + Docker), and SLA guarantees. Use Verdaccio for dev/CI caching; managed registry for your production artifact pipeline.