diff --git a/packages/types/index.ts b/packages/types/index.ts
index 5b9742305..d8a18b634 100644
--- a/packages/types/index.ts
+++ b/packages/types/index.ts
@@ -36,14 +36,10 @@ export interface StartUpConfig {
 // legacy should be removed in long term
 
 export interface LegacyPackageList {
-  [key: string]: LegacyPackageAccess;
+  [key: string]: PackageAccessAddOn;
 }
 
-export type LegacyPackageAccess = PackageAccess & {
-  allow_publish?: string[];
-  allow_proxy?: string[];
-  allow_access?: string[];
-  proxy_access?: string[];
+export type PackageAccessAddOn = PackageAccess & {
   // FIXME: should be published on @verdaccio/types
   unpublish?: string[];
 }
diff --git a/packages/utils/src/config-utils.ts b/packages/utils/src/config-utils.ts
index 6f49617d4..689f2bfa9 100644
--- a/packages/utils/src/config-utils.ts
+++ b/packages/utils/src/config-utils.ts
@@ -19,26 +19,25 @@ const BLACKLIST = {
  * Normalize user list.
  * @return {Array}
  */
-export function normalizeUserList(oldFormat: any, newFormat: any): any {
-  const result: any[][] = [];
-  /* eslint prefer-rest-params: "off" */
-
-  for (let i = 0; i < arguments.length; i++) {
-    if (arguments[i] == null) {
-      continue;
+export function normalizeUserList(groupsList: any): any {
+    const result: any[] = [];
+    if (_.isNil(groupsList)) {
+      return result;
     }
 
     // if it's a string, split it to array
-    if (_.isString(arguments[i])) {
-      result.push(arguments[i].split(/\s+/));
-    } else if (Array.isArray(arguments[i])) {
-      result.push(arguments[i]);
+    if (_.isString(groupsList)) {
+      const groupsArray = groupsList.split(/\s+/);
+
+      result.push(groupsArray);
+    } else if (Array.isArray(groupsList)) {
+      result.push(groupsList);
     } else {
       throw ErrorCode.getInternalError(
-        'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(arguments[i])
+        'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(groupsList)
       );
     }
-  }
+
   return _.flatten(result);
 }
 
@@ -110,25 +109,26 @@ export function normalisePackageAccess(packages: LegacyPackageList): LegacyPacka
   const normalizedPkgs: LegacyPackageList = { ...packages };
   // add a default rule for all packages to make writing plugins easier
   if (_.isNil(normalizedPkgs['**'])) {
-    normalizedPkgs['**'] = { access: [], publish: [], proxy: [] };
+    normalizedPkgs['**'] = {
+      access: [],
+      publish: [],
+      proxy: []
+    };
   }
 
   for (const pkg in packages) {
     if (Object.prototype.hasOwnProperty.call(packages, pkg)) {
-      assert(
-        _.isObject(packages[pkg]) && _.isArray(packages[pkg]) === false,
-        `CONFIG: bad "'${pkg}'" package description (object expected)`
-      );
-      normalizedPkgs[pkg].access = normalizeUserList(packages[pkg].allow_access, packages[pkg].access);
-      delete normalizedPkgs[pkg].allow_access;
-      normalizedPkgs[pkg].publish = normalizeUserList(packages[pkg].allow_publish, packages[pkg].publish);
-      delete normalizedPkgs[pkg].allow_publish;
-      normalizedPkgs[pkg].proxy = normalizeUserList(packages[pkg].proxy_access, packages[pkg].proxy);
-      delete normalizedPkgs[pkg].proxy_access;
+      const packageAccess = packages[pkg];
+      const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;
+      assert(isInvalid, `CONFIG: bad "'${pkg}'" package description (object expected)`);
+
+      normalizedPkgs[pkg].access = normalizeUserList(packageAccess.access);
+      normalizedPkgs[pkg].publish = normalizeUserList(packageAccess.publish);
+      normalizedPkgs[pkg].proxy = normalizeUserList(packageAccess.proxy);
       // if unpublish is not defined, we set to false to fallback in publish access
-      normalizedPkgs[pkg].unpublish = _.isUndefined(packages[pkg].unpublish)
+      normalizedPkgs[pkg].unpublish = _.isUndefined(packageAccess.unpublish)
         ? false
-        : normalizeUserList([], packages[pkg].unpublish);
+        : normalizeUserList(packageAccess.unpublish);
     }
   }
 
diff --git a/packages/utils/src/utils.ts b/packages/utils/src/utils.ts
index 3173e84c2..dbdd1863e 100644
--- a/packages/utils/src/utils.ts
+++ b/packages/utils/src/utils.ts
@@ -33,11 +33,12 @@ import {
   getCode,
 } from '@verdaccio/commons-api';
 
-import { IncomingHttpHeaders } from 'http2';
+import { IncomingHttpHeaders } from 'http';
 
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 
+// FIXME: this is fixed, should pick the package.json or official version
 const pkgVersion = '5.0.0';
 const pkgName = 'verdaccio';
 
diff --git a/packages/utils/test/config-utils.spec.ts b/packages/utils/test/config-utils.spec.ts
index 214e0d775..44f3e6830 100644
--- a/packages/utils/test/config-utils.spec.ts
+++ b/packages/utils/test/config-utils.spec.ts
@@ -8,7 +8,8 @@ import {parseConfigFile} from '../src/utils';
 import {
   getMatchedPackagesSpec,
   hasProxyTo,
-  normalisePackageAccess, sanityCheckUplinksProps,
+  normalisePackageAccess,
+  sanityCheckUplinksProps,
   uplinkSanityCheck
 } from '../src/config-utils';
 
@@ -132,6 +133,7 @@ describe('Config Utilities', () => {
       const access = normalisePackageAccess(packages);
 
       expect(access).toBeDefined();
+
       const scoped = access[`${PACKAGE_ACCESS.SCOPE}`];
       const all = access[`${PACKAGE_ACCESS.ALL}`];
       const react = access['react-*'];
@@ -141,13 +143,12 @@ describe('Config Utilities', () => {
 
       // Intended checks, Typescript should catch this, we test the runtime part
       // @ts-ignore
-      expect(react.access[0]).toBe(ROLES.$ALL);
-      expect(react.publish).toBeDefined();
+      expect(react.access).toEqual([]);
       // @ts-ignore
       expect(react.publish[0]).toBe('admin');
       expect(react.proxy).toBeDefined();
       // @ts-ignore
-      expect(react.proxy[0]).toBe('uplink2');
+      expect(react.proxy).toEqual([]);
       expect(react.storage).toBeDefined();
 
       expect(react.storage).toBe('react-storage');
@@ -158,9 +159,6 @@ describe('Config Utilities', () => {
       expect(all.storage).not.toBeDefined();
       expect(all.publish).toBeDefined();
       expect(all.proxy).toBeDefined();
-      expect(all.allow_access).toBeUndefined();
-      expect(all.allow_publish).toBeUndefined();
-      expect(all.proxy_access).toBeUndefined();
     });
 
     test('should check not default packages access', ()=> {