[BUG] unpublish from private registry

[alberto-schena-gizero]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When trying to unpublish a package from a private registry, npm looks up from the package in https://registry.npmjs.org.

This is the output from the GitLab pipeline:

$ npm unpublish @foo/bar --force
npm WARN using --force Recommended protections disabled.
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/@foo%2fbar - Not found
npm ERR! 404 
npm ERR! 404  '@foo/bar' is not in this registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404 
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2022-01-26T15_10_39_322Z-debug-0.log

Expected Behavior

It should unpublish @foo/bar package from private registry as configured within .npmrc file.

Note: It worked until a week ago (January 18th) using node:latest as pipeline base docker image.

Steps To Reproduce

1. Set up a private registry
2. Publish a package into the private registry
3. Unpublish the package

Environment

• npm: 8.3.2
• Node.js: 17.4.0
• OS Name: Linux
• System Model Name: Debian Bullseye
• npm config:

; "project" config from /builds/bar/.npmrc
@foo:registry = "https://baz.com:4873/" 
access = "restricted" 
registry = "https://registry.npmjs.org/" 
; node bin location = /usr/local/bin/node
; cwd = /builds/bar
; HOME = /root
; Run `npm config ls -l` to show all defaults.
; "publishConfig" from /builds/bar/package.json
; This set of config values will be used at publish-time.
access = "restricted"
cache = "~/.npm"
registry = "https://baz.com:4873"

[0815fox]

I can confirm this bug with [email protected].

I tried it out. It still works with 8.3.0 and stopped working with 8.3.1.

[darcyclarke]

Closing: This should be resolved as of [email protected]

[philblckwd]

Upgraded to v8.6.0 but this still appears to be an issue for me?

[josempineiro]

Upgraded to v8.7.0 and still appears, so it seems

[wraithgar]

If this is still an issue for you please open a new issue describing the steps to reproduce. The bug here was that a package's publishConfig was not being applied during unpublish, which was fixed. It's very likely this is a different bug.

[muzammil360]

The issue still exits with npm 8.19.2.

[mdorda]

Why is the issue closed? It is still issue. Workaround to unpublish from private registry is:

npm unpublish {packageName} --registry {registryUrl}

[wraithgar]

The issue is closed because the bug as reported here was fixed. As I stated in my previous comment if there is something not working for you please open a new issue so we can triage it.

There is another open unrelated unpublish issue here for example #5685