npm registry with path incorrectly handles package-lock.json replacement on Windows

[tillig]

Given your environment is:

• Windows 11
• Python 3.12
• nodeenv 1.9.1
• virtualenv 20.31.2
• Custom .npmrc registry setting in your user folder

When you set up a virtual environment and run an npm install where the package-lock.json has to get the registry value replaced, the host name gets replaced but the path in the registry does not.

This will be easier to explain with a reproduction.

First, set up a .npmrc in your home directory - C:\Users\yourusername\.npmrc - and add a registry that has a path.

registry=https://myregistry.net/repository/npm-registry/

It doesn't matter that this won't restore packages, you'll be able to see the issue regardless.

Now go grab any package.json and package-lock.json that you might have where you've set it up against registry.npmjs.org. I'm using the ones from this repo:

• package.json
• package-lock.json

Now, before you set up any virtual environment, run this:

npm install --loglevel verbose

You'll see that it's getting packages from URLs like https://myregistry.net/repository/npm-registry/yargs/-/yargs-17.7.2.tgz. In the package-lock.json the original URL is https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz and the appropriate host and path were swapped in for the NPMJS registry. That's what's expected.

Now create a virtual environment:

python -mnodeenv --prebuilt --clean-src venv

Activate the virtual environment (.\Scripts\Activate.ps1). Copy the package.json and package-lock.json into the venv folder with your environment.

Now, in the venv folder with the environment activated, run that npm install command again.

npm install --loglevel verbose

When you see the log messages, you'll see paths like https://myregistry.net/yargs/-/yargs-17.7.2.tgz. Note how it's missing the registry path part, /repository/npm-registry/.

This incorrect substitution missing the path causes problems with the ability to use a private registry along with a virtual Node environment.

Note, this only happens on Windows. On Mac it works perfectly, as expected. I'm not sure what's different on Windows but something is different.