[BUG] npm update does not work with scoped private packages

[livthomas]

I'm trying to update a scoped private package using the following command:

npm update @snappykraken/ui-elements

But nothing happens. I can see the following lines in the debug output (--dd):

npm http fetch GET 404 https://registry.npmjs.org/@snappykraken%2fui-elements 2473ms
npm http fetch GET 404 https://registry.npmjs.org/@snappykraken%2fui-elements 1048ms

I guess it should use https://www.npmjs.com/package/@snappykraken/ui-elements instead of https://registry.npmjs.org/@snappykraken%2fui-elements.

Current Behavior:

The latest version of a library doesn't get into node_modules and it is also not changed in package-lock.json.

Expected Behavior:

Both node_modules folder and package-lock.json file should get updated.

Steps To Reproduce:

1. Install a scoped package with npm install
2. Wait until a new version is released (or do it yourself with your own library)
3. Try to update this package with npm update

Environment:

OS: Manjaro Linux (kernel 5.10.23)
Node: v15.11.0
npm: 7.7.5

[livthomas]

I noticed that other scoped packages were downloaded without any problems:

npm http fetch GET 200 https://registry.npmjs.org/@segment%2flocalstorage-retry 16ms (from cache)

So I tried to set NPM_TOKEN environment variable to npm update command and it worked because I have the following line in .npmrc file:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}

But why do I need to do this? Shouldn't npm update prompt me to log in if it is unable to download a private package?

[nlf]

it's requesting the correct url, that package does not exist or requires authentication.

your .npmrc file is telling us that your auth token is stored in the environment variable NPM_TOKEN, if that environment variable is not set then we have no auth token to send and the request will fail. as you've found, by exporting the token as the correct environment variable, the auth will be sent appropriately.

this is an unfortunate change in behavior as npm 6 would throw an error informing you it was unable to replace the environment variable, while npm 7 fails silently and sends no authentication. that's something we should definitely fix.