npm

npm on the Microsoft network or VPN

Use this skill when npm downloads are blocked by the Microsoft corporate network or VPN. Run commands in the affected package directory. Prefer npm ci with the existing lockfile and default registry when access works; do not change dependency versions to solve a network failure.

Use the 1ES public npm feed

When access to npmjs is blocked, retry through the Microsoft 1ES public feed with command-scoped settings:

registry=https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/
npm ci --registry="$registry" --replace-registry-host=npmjs

--replace-registry-host=npmjs routes npmjs lockfile downloads through the selected registry without rewriting the lockfile. Private registries and lifecycle scripts that download from other hosts still need their own approved network access. Do not edit manifests, lockfile URLs, or committed npm configuration just to work around the local VPN.

To diagnose feed access, query an actual package and exact version from the lockfile. For example, substitute the project's pinned package and version in:

npm view [email protected] version --registry="$registry" \
  --fetch-retries=0 --fetch-timeout=15000

Use npm view, not npm ping: the feed may not implement the ping endpoint. A successful metadata query checks that package's availability, not tarball or postinstall access. Retry the original install to verify recovery.

If the feed returns an authentication error or lacks the pinned package, report the blocker rather than guessing credentials or trying arbitrary mirrors. Caching an upstream package can require feed permissions.

Proxy and certificate failures

The feed is an npm registry, not an HTTP proxy. Never set HTTPS_PROXY or HTTP_PROXY to the feed URL. If a forward proxy is required, use only an IT-approved proxy URL in the current shell and check NO_PROXY for unintended bypasses. Do not expose proxy credentials or copy machine-specific configuration into the repository or logs.