In config.yaml, an option encryption could be added in auth > htpasswd with several choices.
By default, a secured one would be expected, making a new verdaccio node safe for the user registering with npm adduser.

Currently, we support verify on multiple formats but we do not on the sign the password, we shoud allow this plugin to sign with something different than CRYPT

To clarify this, we do not sign but hash using crypt-DES.
Signed messages with hashing would be HMAC algorithms like HMAC-SHA256. But this is not recommended for passwords.

https://security.stackexchange.com/questions/3165/hmac-why-not-hmac-for-password-storage

Instead we should target bcrypt, scrypt (sodium) and so on.

So the option should be something like hashing_algorithm.

scrypt is in Node since 10.5, see https://nodejs.org/api/crypto.html#crypto_crypto_scrypt_password_salt_keylen_options_callback

For others we have to check if we can use node-forge, crypto-js and / or bcrypt.

Additionally the SHA-3 winner (Keccak) could be an option too (if some need it) available as sha3 and keccak.

But we should prefer bcrypt and scrypt. For both we can set the rounds / interations and so the hashing_algorithm should support further settings like the rounds / iterations and other input variables.

See https://gchq.github.io/CyberChef/?op=Bcrypt and https://gchq.github.io/CyberChef/?op=Scrypt

An example of plugin bcrypt using https://github.com/idangozlan/verdaccio-bitbucket

What a coincidence I'm working on the same issue on some of my projects. I don't have full knowledge about what you do to fix the issue but I just bump to those articles:

This one is for strengthening ldap passwords using linux crypt: https://www.redpill-linpro.com/techblog/2016/08/16/ldap-password-hash.html. I don't even know that crypt would generate passwords in another formats, so on ldap you generate a SHA512, SHA256 or Blowfish and stored it the hash signaled as crypt and ldap will use the lib with that strong algo pointed in the hash.

This one is about peper and how to validate the generated hash: https://crackstation.net/hashing-security.htm. In the case of pepper that must be considered well as old passwords are not peppered so you have a compatibility issue that should be solved in your system before.

On my projects I can get direct interface to unix cyrpt but I don't know if there is anything available in JavaScript.

I hope that could be useful information on this task.

Thanks @piraz really appreciated 👏