Current Behavior:

I am attempting to configure a project to install dependencies from NPM. I will be publishing the project to GitHub Packages as a private package. If I use this syntax in my project's .npmrc:

@my-org:registry=https://npm.pkg.github.com/

I can install dependencies from NPM using npm install on my local machine. However, I cannot publish to GitHub Packages using npm publish. NPM informs me that I'm not authenticated. If I use this syntax in my project's .npmrc:

registry=https://npm.pkg.github.com/my-org/

I can publish using npm publish, but I cannot install dependencies with npm install. NPM informs me that it's trying to install dependencies from GitHub Packages, rather than NPM.

Expected Behavior:

Based on my reading, both syntaxes should be compatible with npm install and npm publish. However, it appears I can only use one or the other, based on my intended use.

Steps To Reproduce:

1. Install Node v15.7.0 and NPM 7.4.3 via nvm.

2. Log in to GitHub Packages with the command:

   npm login --scope=@my-org --registry=https://npm.pkg.github.com
   

3. Check our ~/.npmrc file in our home folder. It should read:

   @my-org:registry=https://npm.pkg.github.com/
   //npm.pkg.github.com/:_authToken=<auth-token-used-for-login>
   

4. Create project with the following package.json:

   {
     "name": "@my-org/my-package",
     "description": "A test.",
     "version": "1.0.0",
     "scripts": {
       "test": "echo \"Error: no test specified\" && exit 1"
     },
     "repository": {
       "type": "git",
       "url": "https://github.com/my-org/my-package.git"
     },
     "keywords": ["example"],
     "author": "Me",
     "license": "ISC",
     "bugs": {
       "url": "https://github.com/my-org/my-package/issues"
     },
     "homepage": "https://github.com/my-org/my-package",
     "dependencies": {
       "bootstrap": "^4.5.2"
     }
   }
   

5. Add the following .npmrc to our project:

   @my-org:registry=https://npm.pkg.github.com/
   

6. Run npm install. Installation should succeed.

7. Run npm publish. Receive the following error:

   npm ERR! code ENEEDAUTH
   npm ERR! need auth This command requires you to be logged in.
   npm ERR! need auth You need to authorize this machine using `npm adduser`
   
   npm ERR! A complete log of this run can be found in:
   npm ERR!     /Users/my-user/.npm/_logs/2021-01-28T20_19_55_974Z-debug.log
   

8. Change the project .npmrc to:

   registry=https://npm.pkg.github.com/my-org/
   

9. Run npm publish. Publishing should succeed.

10. rm -rf node_modules/ package-lock.json in project.

11. Run npm install. Receive following error:

    npm ERR! code E401
    npm ERR! Incorrect or missing password.
    npm ERR! If you were trying to login, change your password, create an
    npm ERR! authentication token or enable two-factor authentication then
    npm ERR! that means you likely typed your password in incorrectly.
    npm ERR! Please try again, or recover your password at:
    npm ERR!     https://www.npmjs.com/forgot
    npm ERR!
    npm ERR! If you were doing some other operation then your saved credentials are
    npm ERR! probably out of date. To correct this please try logging in again with:
    npm ERR!     npm login
    
    npm ERR! A complete log of this run can be found in:
    npm ERR!     /Users/my-user/.npm/_logs/2021-01-28T20_38_20_711Z-debug.log
    

Environment:

• OS:
  • MacOS Catalina 10.15.7
  • MacOS Big Sur 11.1
• Node: 15.7.0
• npm: 7.4.3

Things I've tried

Using publishConfig

Unfortunately, publishConfig doesn't fix the issue. It also doesn't address that the two .npmrc syntaxes produce different results.

Project .npmrc authToken

NPM's documentation states there is no need to include the authToken in the project .npmrc. Authenticating with npm login and storing the authToken in the global ~/.npmrc should be sufficient.

Workaround

Using the --registry command line flag

I've found a workaround until the NPM bug affecting this issue is resolved. When using the following project .npmrc syntax:

@my-org:registry=https://npm.pkg.github.com/

If I run npm publish --registry=https://npm.pkg.github.com/, I can publish successfully. In addition, I can install dependencies without issue.