Yarn: .npmrc with private registry ignored?

[FezVrasta]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?
Right now, when I run yarn install I get a 403 Forbidden error from Artifactory as soon Yarn tries to fetch an @acme scoped package, but my local .npmrc defines valid credentials.

The weird thing is that if I run a Docker container that basically does:

FROM centos
RUN yum install yarn
ARG NODE_VERSION=8.5.0
RUN curl -sL https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-x64.tar.gz | tar xz --strip-components 1 -C /usr/local
WORKDIR /app
COPY app .
COPY .npmrc .
RUN yarn install --pure-lockfile --non-interactive

it works just fine.

If the current behavior is a bug, please provide the steps to reproduce.
.npmrc:

@acme:registry=https://acme.jfrog.io/acme/api/npm/npm/
//acme.jfrog.io/acme/api/npm/npm/:_password=XXXXXXXXX
//acme.jfrog.io/acme/api/npm/npm/:username=automated.read
//acme.jfrog.io/acme/api/npm/npm/:[email protected]
//acme.jfrog.io/acme/api/npm/npm/:always-auth=true

What is the expected behavior?
The installation should work.

Please mention your node.js, yarn and operating system version.

❯ node -v
v8.9.4

❯ yarn -v
1.5.1

❯ sw_vers -productVersion
10.13.3

[FezVrasta]

It looks like that if instead of _password I use _auth it works better, but it returns 404 errors on other scoped packages outside of @acme. I had to change it to look like this to work properly.

````
registry=https://registry.npmjs.org/

@acme:registry=https://acme.jfrog.io/acme/api/npm/npm/
//acme.jfrog.io/acme/api/npm/npm/:_auth=YYYYYYYYYYYYYYYYYYYYYYYYYY
//acme.jfrog.io/acme/api/npm/npm/:username=automated.read
//acme.jfrog.io/acme/api/npm/npm/:[email protected]
//acme.jfrog.io/acme/api/npm/npm/:always-auth=true
````

I don't think this is expected because:

1. Shouldn't _password work as well?
2. Shouldn't the global .npmrc be used along with the local one?

[vinodloha]

It looks like that if instead of _password I use _auth it works better, but it returns 404 errors on other scoped packages outside of @acme. I had to change it to look like this to work properly.

registry=https://registry.npmjs.org/

@acme:registry=https://acme.jfrog.io/acme/api/npm/npm/
//acme.jfrog.io/acme/api/npm/npm/:_auth=YYYYYYYYYYYYYYYYYYYYYYYYYY
//acme.jfrog.io/acme/api/npm/npm/:username=automated.read
//acme.jfrog.io/acme/api/npm/npm/:[email protected]
//acme.jfrog.io/acme/api/npm/npm/:always-auth=true

I don't think this is expected because:

1. Shouldn't _password work as well?
2. Shouldn't the global .npmrc be used along with the local one?

This comment above solved my issue of NPM install failing randomly with @scoped packages when you have private registry set. I had spend days struggling to solve it.

The idea is to not let NPM use your private nexus credentials with https://registry.npmjs.org/ request.