diff --git a/lib/local-storage.js b/lib/local-storage.js
index 8d78e162e..18c85b050 100644
--- a/lib/local-storage.js
+++ b/lib/local-storage.js
@@ -463,7 +463,7 @@ Storage.prototype.get_recent_packages = function(startkey, callback) {
 		files.forEach(function(file) {
 			fs.stat(storage.path, function(err, stats) {
 				if (err) return callback(err)
-				if (stats.mtime > startkey) {
+				if (stats.mtime > startkey && utils.validate_name(file)) {
 					list.push({
 						time: stats.mtime,
 						name: file
diff --git a/test/functional/config-1.yaml b/test/functional/config-1.yaml
index 38ce0e413..03a2c9683 100644
--- a/test/functional/config-1.yaml
+++ b/test/functional/config-1.yaml
@@ -4,7 +4,7 @@ users:
   test:
     password: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
 
-users_file: ./test-storage/htpasswd
+users_file: ./test-storage/.htpasswd
 max_users: 1
 
 web:
diff --git a/test/functional/newnpmreg.js b/test/functional/newnpmreg.js
index 020429ffa..11944deb7 100644
--- a/test/functional/newnpmreg.js
+++ b/test/functional/newnpmreg.js
@@ -11,6 +11,7 @@ function sha(x) {
 module.exports = function() {
 	var server = process.server
 	var server2 = process.server2
+	var express = process.express
 
 	describe('newnpmreg', function() {
 		before(function(cb) {
@@ -84,5 +85,48 @@ module.exports = function() {
 				cb()
 			})
 		})
+
+		describe('search', function() {
+			function check(obj) {
+				obj.testpkg.time.modified = '2014-10-02T07:07:51.000Z'
+				assert.deepEqual(obj.testpkg, {
+					"name": "testpkg",
+					"dist-tags": {
+						"latest": "0.0.1"
+					},
+					"maintainers": [],
+					"readmeFilename": "",
+					"time": {
+						"modified": "2014-10-02T07:07:51.000Z"
+					},
+					"versions": {
+						"0.0.1": "latest"
+					}
+				})
+			}
+
+			before(function(cb) {
+				express.get('/-/all', function(req, res) {
+					res.send({})
+				})
+				cb()
+			})
+
+			it('server1 - search', function(cb) {
+				server.request({uri:'/-/all'}, function(err, res, body) {
+					assert.equal(res.statusCode, 200)
+					check(body)
+					cb()
+				})
+			})
+
+			it('server2 - search', function(cb) {
+				server2.request({uri:'/-/all'}, function(err, res, body) {
+					assert.equal(res.statusCode, 200)
+					check(body)
+					cb()
+				})
+			})
+		})
 	})
 }