Skip to content

[BUG] npm 11 does not respect registry protocol when fetching package #8472

@Jeepsboucher

Description

@Jeepsboucher

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

Hi,

We have an intern registry who is using HTTP protocol. For example: http://npm.example.com:9090.
We are adding the registry like this: npm config set registry http://npm.example.com:9090
When doing a npm ci or a npm install with npm 11.5.1 it replace the registry protocol for https even if my registry use http.

npm http fetch GET https://npm.example.com:9090/which/-/which-1.3.1.tgz attempt 3 failed with ERR_SSL_WRONG_VERSION_NUMBER
npm http fetch GET https://npm.example.com:9090/websocket-extensions/-/websocket-extensions-0.1.4.tgz attempt 3 failed with ERR_SSL_WRONG_VERSION_NUMBER
npm http fetch GET https://npm.example.com:9090/websocket-driver/-/websocket-driver-0.7.4.tgz attempt 3 failed with ERR_SSL_WRONG_VERSION_NUMBER

By switching of version, I found that the problem came after npm 11.2.0 and I think is cause by #8185 because the protocol is not replace with the registryURL.protocol.
I honestly try to make the change but I didn't succeeded to build a debug version of the cli.

Expected Behavior

When i switch back to NPM 11.2.0 the procotol stay to http when fetching package:

npm http fetch GET 200 http://npm.example.com:9090/which/-/which-1.3.1.tgz 3952ms (cache miss)
npm http fetch GET 200 http://npm.example.com:9090/websocket-extensions/-/websocket-extensions-0.1.4.tgz 4177ms (cache miss)
npm http fetch GET 200 http://npm.example.com:9090/websocket-driver/-/websocket-driver-0.7.4.tgz 6055ms (cache miss)

Steps To Reproduce

We can reproduce the problems using a fake registry like http://localhost:9091

  1. Add a registry in HTTP: npm config set registry http://localhost:9091
  2. Use npm ci to fetch the packages
  3. You will see that when package are missing from the cache we will try to get them using https instead of http from the fake registry:
npm http fetch GET https://localhost:9091/wrap-ansi/-/wrap-ansi-6.2.0.tgz attempt 1 failed with ECONNREFUSED
npm http fetch GET https://localhost:9091/watchpack/-/watchpack-2.4.4.tgz attempt 1 failed with ECONNREFUSED
npm http fetch GET https://localhost:9091/void-elements/-/void-elements-2.0.1.tgz attempt 1 failed with ECONNREFUSED

Environment

  • npm: 11.5.1
  • Node.js: 22.17.1
  • OS Name: Windows
  • System Model Name:
  • npm config:
registry = "http://npm.example.com:9090"

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v22.17.1
; npm local prefix = C:\DEV
; npm version = 11.5.1
; cwd = C:\DEV
; HOME = C:\Users\some_user
; Run `npm config ls -l` to show all defaults.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next steps

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions