[BUG] E401 error message does not use the configured registry
Maintainers usually reply within 1 day
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 75/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- javascript, nodejs
- Domain
- cli, developer-experience
Research direction
The error message is generated in lib/utils/error-message.js at line 159. Start by examining that file to see how the registry URL is currently hardcoded. Check how npm retrieves the configured registry (likely from npm.config). Modify the error message to use the configured registry's root URL. Test by setting a custom registry in .npmrc and triggering a 401 error with an npm command like npm whoami or npm install without authentication.
Written by the indexing model from the issue text.
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
This is not just a request to bump a dependency for a CVE
- This is not solely a request to bump a dependency for a CVE
Current Behavior
When npm has a 401 error, it constructs an error message that suggests recovering your password. But this error message has a hard-coded https://npmjs.org link, which is misleading when the authentication error occurred with a private npm registry, not the default npmjs.org registry.
Expected Behavior
The error message should display a link to the root of the custom registry if it is set, and fall back to the default https://npmjs.org/forgot. Note the custom registry likely won't be able to point to a /forgot subpage, but defaulting to the root of the custom registry would be more clear.
The reasoning for this request is that it is confusing for developers experiencing auth errors to see a link to the public npm registry when our team exclusively uses an internal mirror.
Steps To Reproduce
- Set up a .npmrc to point to an npm registry that requires authentication
- Make an npm install WITHOUT authenticating
- It should return a 401 with the error
npm error code E401 npm error Incorrect or missing password. npm error If you were trying to login, change your password, create an authentication token or enable two-factor authentication then that means you likely typed your password in incorrectly. npm error Please try again, or recover your password at: npm error https://www.npmjs.com/forgot npm error npm error If you were doing some other operation then your saved credentials are probably out of date. npm error To correct this please try logging in again with: npm error npm login npm error A complete log of this run can be found in: /home/kmurphy/.npm/_logs/2026-09-22T16_19_31_269Z-debug-0.log
The source code for the hard-coded error message is at:
Environment
- npm: 12.0.1
- Node.js: 26.10.0
- OS Name: Ubuntu 24.04
- System Model Name: all
- npm config:
; "user" config from /home/kmurphy/.npmrc
; //artifactory.mydomain.com/artifactory/api/npm/my-npm-mirror/:_authToken = (protected) ; overridden by project
; "project" config from /home/kmurphy/dev/MyProject/MySubdir/.npmrc
//artifactory.mydomain.com/artifactory/api/npm/my-npm-mirror/:_authToken = (protected)
registry = "https://artifactory.mydomain.com/artifactory/api/npm/my-npm-mirror/"
; node bin location = /home/kmurphy/.nvm/versions/node/v26.10.0/bin/node
; node version = v26.10.0
; npm local prefix = /home/kmurphy/dev/MyProject/MySubdir
; npm version = 12.0.2
; cwd = /home/kmurphy/dev/MyProject/MySubdir
; HOME = /home/kmurphy
; Run `npm config ls -l` to show all defaults.
- Dominant language
- JavaScript
- Stars
- 10.2k
- Forks
- 4.8k
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 12
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from npm/cli
-
[BUG] v12.2.0 shipped a stale bundled lockfile after in-range security fixes were already publishedPossibly taken @reggi claimed this 7 days ago. OpenPriority 1
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
npm/cli#10062 · 1 comment · 1 assignee ·
Maintainers usually reply within 1 day
-
create node pr: Node.js 20 deprecation & `DEP0040` warnings loggedPossibly taken @lazerg claimed this 19 days ago. OpenEngineering Priority 1
Difficulty 1/5 Under an hour Newbie friendliness 80/100
Maintainers usually reply within 1 day
-
Engineering Priority 2
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
`npm audit signatures` does not report how many packages it skipped for want of registry keysPossibly taken @greenlincoln05 claimed this 16 days ago. OpenPriority 3
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
[DOCS] Clarify whether `os`, `cpu`, and `libc` accept a string or must be an arrayPossibly taken @SatvikMishra08 claimed this 16 days ago. OpenDocumentation Priority 2
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
Similar issues
-
Notifications pagination accepts NaN and negative LIMIT/OFFSETPossibly taken @Senthil455 claimed this today. OpenBUGS MEDIUM
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
elixpo/blogs.elixpo#419 · 2 comments ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
immich-app/immich#32426 ·
Maintainers usually reply within 1 day
-
automated issue report
Difficulty 1/5 Under an hour Newbie friendliness 70/100
lirantal/discoprint#45 ·
Maintainers usually reply within 1 day