Verdaccio Setup - Private Unity Scoped Registry (with OpenUPM fallback)

config.yaml

storage: /verdaccio/storage/data
plugins: /verdaccio/plugins
auth:
  htpasswd:
    file: /verdaccio/storage/htpasswd
    algorithm: bcrypt
uplinks:
#  npmjs:
#    url: https://registry.npmjs.org/
  openupm:
    url: https://package.openupm.com/
packages:
#  '@*/*':
#    access: $all
#    publish: $authenticated
#    proxy: npmjs
  '**':
    access: $authenticated
    publish: $authenticated
    unpublish: $authenticated
    proxy: openupm
server:
  keepAliveTimeout: 60
max_body_size: 100mb
middlewares:
  audit:
    enabled: true
log: { type: stdout, format: pretty, level: http }

docker-start.sh

#!/bin/bash
docker run -it --rm --name verdaccio \
  -p 4873:4873 \
  -v ./conf:/verdaccio/conf \
  -v ./storage:/verdaccio/storage \
  -v ./plugins:/verdaccio/plugins \
  verdaccio/verdaccio

• OpenUPM - Host Your Private Unity Scoped Registry in Just 15 Minutes

• Security advisory when using proxy config:
  Dependency Confusion Vulnerabilities in Unity Game Development