$nobody access rule or whitelist users

I didn’t find about how to close access to publish to somebody not from team.

  '**':
    access: $all
    publish: $authenticated
    proxy: npmjs

Situation: I use @babel/plugin-proposal-decorators in my project. Hacker push @babel/plugin-proposal-decorators package with violence to my register. And then my project pull this violence code… This is a hole in security. Need mechanism to close access to people not in whitelist to push any projects in register.

[suenot]

Previously I didn’t find solution to restrict access in verdaccio. I found only ‘$all’ and ‘$anonymous’ access rules. Therefore I try to suggest a new access rule: $nobody. But later I find in documentation, that I can use: ’ ’ (empty string), ‘undefined’ or username, those access rules solve my problem.

[juanpicado]

Ahh ok, yeah now I understand thanks for the clarification 🙃 .

So, can we close this?