[BUG] npm hangs on gitlab repo install

[nVitius]

Current Behavior:

I am installing a dependency from a private gitlab repo with git+ssh. Every time I install it, npm takes a really long time to complete the installation. I ran it with -ddd and noticed this:

npm http fetch GET 503 https://gitlab.com/users/sign_in 70361ms attempt #3
npm timing reifyNode:node_modules/<gitlab-package-name> Completed in 72435ms

Expected Behavior:

npm doesn't try to sign in to gitlab when installing an ssh package

Steps To Reproduce:

npm i --save git+ssh://gitlab.com/some_user/private_repo#master

Environment:

macOS 11.2.1
node 12.20.1
npm 7.5.4

[nVitius]

@ljharb @darcyclarke @isaacs
Just pinging you guys as I've seen you on some recent issues.

I would love to help debug this, but I don't know where to start. I looked through the codebase a bit, but couldn't find where this endpoint would be called. If you can point me in the right direction at least, I can try to work on this.

[nVitius]

@ljharb @nlf
Pinging you two as I've seen you comment on recent issues.

Please let me know if there's someone else that should be looking at this instead, or if more info is needed here. Thanks!

By the way, I tried this again with npm 7.6.0 and the issue is still occurring.

[dillonbartkus]

I'm having the same problem as well, trying to npm install an internal package.

[dillonbartkus]

@nVitius I don't know if this helps you, but what worked for me was to completely uninstall node / npm (I used this as a guide : https://stackoverflow.com/questions/11177954/how-do-i-completely-uninstall-node-js-and-reinstall-from-beginning-mac-os-x), then re-install node using the downloadable package. Hope this helps.

[nVitius]

@dillonbartkus I'm using node/npm with nvm. After you reinstalled, are you still using npm version 7.6.0?

[dillonbartkus]

@nVitius I picked LTS version, which uses NPM version 6.14.11

[nlf]

using 7.6.0, can you try the same command but with --loglevel=silly at the end and share the log?

[nVitius]

@nlf that's what -ddd does. I can post the whole log, but it's not very informative around that section in particular:
https://pastebin.com/rB3teabE

The relevant lines are 127-129. Here's a screencap:

It looks like this is only happening with Gitlab repos. Installing a Github repo with git+ssh does not cause this issue.

[nlf]

what do you get if you run:

git ls-remote ssh://git@gitlab.com/wake_up_warror/warrior-vue-shared.git

in a shell? does it prompt you for anything?

[nlf]

if it does, and you accept the prompt, then a follow up npm install command should work as expected

additionally, if when you run the npm install command you see something like

The authenticity of host 'gitlab.com (2606:4700:90:0:f22e:fbec:5bed:a9b9)' can't be established.
ECDSA key fingerprint is SHA256:HbW3g8zUjNSksFbqTiUWPWg2Bq1x8xdGUrliXFzSnUw.

even though we're hiding the line that tells you to press enter, if you press enter the installation will continue.

a way to prevent this from happening in the first place would be to

export GIT_SSH_COMMAND="ssh -oStrictHostKeyChecking=accept-new"

somewhere in your shell profile, which will automatically accept keys that are not in your ~/.ssh/known_hosts but will verify keys that are there have not changed.