The registry was set globally ( egistry=...), which forced all public transitive deps through the private Verdaccio. Verdaccio has no uplink, so pm install 404'd on public packages. Scope the registry to @aetoskia:registry=... so public deps resolve from npmjs and only @aetoskia/* go to the private registry.