Verdaccio - publish without being logged in?

Question

so if I understand verdaccio docs correctly, I should be able to publish a package if I set "publish" to "$all" in the config file.

But even though my config file looks like this:

storage: ./storage
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  '@*/*':
    access: $all
    publish: $all
    proxy: npmjs
  '**':
    proxy: npmjs
logs:
  - {type: stdout, format: pretty, level: http}

if I try to publish a scoped package the command npm publish fails with ENEEDAUTH

am I missing something?

Can somebody tell me how to publish a package to my private verdaccio repo WITHOUT have to be authenticated?

npm version: 7.4.3 node version: 15.7.0 verdaccio version: 4.11.0

Answer 1

Originally posted here

https://twitter.com/verdaccio_npm/status/1357798427283910660?s=21

But in a nutshell, npm@7 requires a token to publish, thus, is just a matter of fake a token to bypass npm. Verdaccio won't be able to verify the token and will fallback to an anonymous user, since your package access is set to $all this role is also included for anonymous users.