[BUG] NPM 10 ignores proxy configuration via environment variables

[fgreinacher]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

NPM ignores proxy configuration via environment variables (e.g. HTTP_PROXY/HTTPS_PROXY).

$ docker run -it --entrypoint bash node@sha256:aefb5eb8adedb87e89595293e12e5e6e2e5c182801e48671d4b1d6b0caa69f29
root@48bff5fa8f02:/# node --version
v20.7.0
root@48bff5fa8f02:/# npm --version
10.1.0
root@48bff5fa8f02:/# npm cache clean --force && HTTPS_PROXY=http://invalid npm install --global leftpad
npm WARN using --force Recommended protections disabled.
npm WARN deprecated leftpad@0.0.1: Use the built-in String.padStart function instead

added 1 package in 1s

Expected Behavior

NPM respects the proxy variables as documented:

$ docker run -it --entrypoint bash node@sha256:14bd39208dbc0eb171cbfb26ccb9ac09fa1b2eba04ccd528ab5d12983fd9ee24
root@4c9745d8fc3c:/# node --version
v20.6.1
root@4c9745d8fc3c:/# npm --version
9.8.1
root@4c9745d8fc3c:/# npm cache clean --force && HTTPS_PROXY=http://invalid npm install --global leftpad
npm WARN using --force Recommended protections disabled.
npm ERR! code ENOTFOUND
npm ERR! syscall getaddrinfo
npm ERR! errno ENOTFOUND
npm ERR! network request to https://registry.npmjs.org/leftpad failed, reason: getaddrinfo ENOTFOUND invalid
npm ERR! network This is a problem related to network connectivity.
npm ERR! network In most cases you are behind a proxy or have bad network settings.
npm ERR! network
npm ERR! network If you are behind a proxy, please make sure that the
npm ERR! network 'proxy' config is set properly.  See: 'npm help config'

npm ERR! A complete log of this run can be found in: /root/.npm/_logs/2023-09-25T15_11_42_520Z-debug-0.log

Steps To Reproduce

See above.

Environment

• npm: 10.1.0
• Node.js: v20.7.0
• OS Name: Debian GNU/Linux 12 (bookworm)
• System Model Name: Irrelevant
• npm config: Irrelevant

[fgreinacher]

This regression is probably caused by npm/make-fetch-happen#255

[CoaxVex]

Seeing the same issue. We're setting http_proxy and https_proxy environment variables, but npm ignores the configuration.

code ETIMEDOUT
errno ETIMEDOUT
network request to https://npm.fontawesome.com/@fortawesome/react-fontawesome/-/XXX/react-fontawesome-xxxxx.tgz failed, reason:
network This is a problem related to network connectivity.
network In most cases you are behind a proxy or have bad network settings.
network 
ERR! network If you are behind a proxy, please make sure that the
network 'proxy' config is set properly.  See: 'npm help config'
A complete log of this run can be found in: /build/.npm/_logs/2023-09-25T14_17_20_257Z-debug-0.log

Reverting to node 18 and npm 9.8.1 solves the issue.

[fgreinacher]

@wraithgar @lukekarrys As you have worked on the make-fetch-happen PR, could you maybe support here a bit? Sorry for pinging, but it's quite a severe regression and I assume it breaks many builds.

[lukekarrys]

Thanks for the ping @fgreinacher, I will take a look at this.

[Abukodonosor]

Are you maybe interested in implementing the Malicious Packages/Code checker, when someone uploads the package to the registry?

Let me know some thoughts about that :)

Sorry for picking wrong spot, but this is the best place to get quick answer 🍡

[lenaing]

For those who are looking for a workaround (not always a solution, depends on your context, only if you really don't rely on environment variables) :

    npm config set noproxy $NO_PROXY
    npm config set proxy $HTTP_PROXY
    npm config set https-proxy $HTTPS_PROXY

Unlocked us behind a corporate proxy with authentication :)