npm auth token used on private repo for scoped packages #2953
Description
Do you want to request a feature or report a bug?
bug
What is the current behavior?
$ cat .yarnrc
registry "http://example.com/nexus/repository/npm-repositories"
$ cat ~/.npmrc
//registry.npmjs.org/:_authToken=xxxxxxx
$ yarn --verbose
yarn install v0.21.3
verbose 0.232 current time: 2017-03-19T20:32:51.471Z
info No lockfile found.
[1/4] 🔍 Resolving packages...
verbose 0.468 Performing "GET" request to "http://example.com/nexus/repository/npm-repositories/@types%2fnode".
verbose 0.863 Request "http://example.com/nexus/repository/npm-repositories/@types%2fnode" finished with status code 401.
verbose 0.864 Error: Couldn't find package "@types/node" on the "npm" registry.
at /usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/lib/resolvers/registries/npm-resolver.js:209:15
at Generator.next (<anonymous>)
at step (/usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
at /usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:13
at process._tickCallback (internal/process/next_tick.js:109:7)
error Couldn't find package "@types/node" on the "npm" registry.
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
$ curl -v http://example.com/nexus/repository/npm-repositories/@types%2fnode > /dev/null 2>&1 | grep HTTP
> GET /nexus/repository/npm-repositories/@types%2fnode HTTP/1.1
< HTTP/1.1 200 OK
$ mv ~/.npmrc ~/.npmrc_original
$ yarn
[...]
✨ Done in 2.98s
(Host name and auth token replaced with dummy for privacy reasons.)
If the current behavior is a bug, please provide the steps to reproduce.
See above.
What is the expected behavior?
Do not use npm's auth token on a private repository for scoped packages.
Please mention your node.js, yarn and operating system version.
$ node --version
v7.7.3
$ yarn --version
0.21.3