Organization access doesn't apply to package in GitHub NPM registry

[dnwjn]

Hello everyone,

We're having issues with access and GitHub's NPM registry. Our situation is as follows:

1. A member has the Member role in our organization
2. The member is part of the Core team
3. The Core team has access to a private repository within our organization using the All-repository maintain Organization access
4. The member has a classic personal access token with the package:read permission
5. The token has been set correctly inside the .npmrc file
6. When the member tries to install the package, they receive a 403 error saying permission_denied: read_package

What's weird is that when a member with the Owner organization role tries the above, it works. All is the same, except for the member roles. Furthermore, when we give the Core team Direct access, everything also works.

Are we missing something in our settings, or is this a bug?

Appreciate any help we can get!