[BUG] NPM v10.0.0 fails to communicate correctly with HTTP proxy (HTTP 400)

[aureq]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Part of my work environment, I'm regularly updating nodejs (stable) and npm (latest via https://www.npmjs.com/install.sh). That same work environment requires me to use a proxy in order to access the Internet (see config below).

As part of my setup, I install core npm packages such as eslint and typescript-eslint (latest versions) globally onto my system. I do so by running npm install -g 'typescript-eslint@latest' --verbose --debug

However, as of npm v10.0.0 released 2 days ago, I'm unable to download & install my required packages. The npm command returns:

npm verb cli /usr/local/bin/node /usr/local/bin/npm
npm info using npm@10.0.0
npm info using node@v18.17.1
npm verb title npm install typescript-eslint@latest
npm verb argv "install" "--global" "typescript-eslint@latest" "--loglevel" "verbose" "--debug"
npm verb logfile logs-max:10 dir:/root/.npm/_logs/2023-09-03T03_17_48_820Z-
npm verb logfile /root/.npm/_logs/2023-09-03T03_17_48_820Z-debug-0.log
npm http fetch GET 400 https://registry.npmjs.org/typescript-eslint 55ms (cache skip)
npm verb stack HttpErrorGeneral: 400 Bad Request - GET https://registry.npmjs.org/typescript-eslint
npm verb stack     at /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:95:15
npm verb stack     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
npm verb stack     at async RegistryFetcher.packument (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:87:19)
npm verb stack     at async RegistryFetcher.manifest (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:118:23)
npm verb stack     at async /usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:527:22
npm verb stack     at async Promise.all (index 0)
npm verb stack     at async #add (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:516:5)
npm verb stack     at async #applyUserRequestsToNode (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:485:7)
npm verb stack     at async #applyUserRequests (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:420:7)
npm verb stack     at async Arborist.buildIdealTree (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:195:7)
npm verb statusCode 400
npm verb pkgid typescript-eslint@latest
npm verb cwd /root
npm verb Linux 6.1.0-11-amd64
npm verb node v18.17.1
npm verb npm  v10.0.0
npm ERR! code E400
npm ERR! 400 Bad Request - GET https://registry.npmjs.org/typescript-eslint
npm verb exit 1
npm verb unfinished npm timer reify 1693711068962
npm verb unfinished npm timer reify:loadTrees 1693711068965
npm verb unfinished npm timer idealTree:userRequests 1693711068970
npm verb code 1

Digging further, it appears npm 10.0.0 sends the following query to the proxy

GET http://registry.npmjs.org:443/typescript-eslint

Squid-cache (proxy) store the query in its log as, which shows the HTTP/400 error code being returned to the client (npm).

Sep 03 03:21:19 eris squid[748682]:     35 192.168.2.71 TCP_MISS/400 508 GET http://registry.npmjs.org:443/typescript-eslint - HIER_DIRECT/104.16.3.35 text/html

However, installing nodejs 18.7.1 and keeping the bundled npm version (npm@9.6.7) doesn't trigger the issue. The proxy log contains a different type of connection.

Sep 03 03:27:33 eris squid[748682]:    993 192.168.2.71 TCP_TUNNEL/200 3244 CONNECT registry.npmjs.org:443 - HIER_DIRECT/104.16.30.34 -

I also upgraded to node v20.5.1 and kept the bundled npm (9.8.0) and it worked fine.

Here is a table to detail my tests and results

node	npm	request received (proxy)	result
v18.17.1	10.0.0	GET http://registry.npmjs.org:443/typescript-eslint	npm ERR! 400 Bad Request - GET https://registry.npmjs.org/typescript-eslint	❌
v18.17.1	9.6.7 (bundled)	CONNECT registry.npmjs.org:443	no error	✅
v20.5.1	9.8.0 (bundled)	CONNECT registry.npmjs.org:443	no error	✅

Expected Behavior

NPM 10.0.0 should be able to download and install packages when using a proxy.

Steps To Reproduce

0. Have a Linux installed and a proxy such as squid-cache
1. Configure npm to use your proxy npm config set proxy "$HTTP_PROXY" && npm config set https-proxy "$HTTPS_PROXY"
2. Install nodejs 18.17.1
3. Install latest npm cli using wget -O - https://www.npmjs.com/install.sh | sh
4. Run npm install -g 'typescript-eslint@latest' --verbose --debug

The last command fails with a HTTP/400 error.

Run the command above but skip step 3 and the last command succeeds.

Environment

• npm: 10.0.0 (affected) & 9.8.0 (ok)
• Node.js: node@v20.5.1 & v18.17.1
• OS Name: Linux Debian 12 - Bookworm (latest)
• System Model Name: amd64
• npm config:

; "user" config from /root/.npmrc

https-proxy = "http://proxy.local.redacted:3129/" 
proxy = "http://proxy.local.redacted:3129/" 

; node bin location = /usr/local/bin/node
; node version = v18.17.1
; npm local prefix = /root
; npm version = 10.0.0
; cwd = /root
; HOME = /root
; Run `npm config ls -l` to show all defaults.```

[BearsPunch]

Have the same issue. Had to rollback

[lukekarrys]

This is fixed in npm@10.1.0 🎉