[BUG] ENOAUDIT issue with 503 on security audits registry over a specific package.json

[WilliamDASILVA]

What / Why

I'm getting a ENOAUDIT error code whenever I run npm audit along with the 503 status on https://registry.npmjs.org/-/npm/v1/security/audits.

When

• Whenever I run npm audit on a specific project.

Where

• npm public registry over the security audits

How

Current Behavior

• Getting a ENOAUDIT error:

root@b5be31c4099a:/app# npm audit -verbose
npm info it worked if it ends with ok
npm verb cli [ '/usr/local/bin/node',
npm verb cli   '/usr/local/bin/npm',
npm verb cli   'audit',
npm verb cli   '-verbose' ]
npm info using npm@6.14.5
npm info using node@v10.9.0
npm verb npm-session 6dcec0c013ba901c
npm http fetch POST 503 https://registry.npmjs.org/-/npm/v1/security/audits 13275ms
npm verb stack Error: Your configured registry (https://registry.npmjs.org/) may not support audit requests, or the audit endpoint may be temporarily unavailable.
npm verb stack     at Bluebird.all.spread.then.catch (/usr/local/lib/node_modules/npm/lib/audit.js:204:18)
npm verb stack     at tryCatcher (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/util.js:16:23)
npm verb stack     at Promise._settlePromiseFromHandler (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:517:31)
npm verb stack     at Promise._settlePromise (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:574:18)
npm verb stack     at Promise._settlePromise0 (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:619:10)
npm verb stack     at Promise._settlePromises (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/promise.js:695:18)
npm verb stack     at _drainQueueStep (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:138:12)
npm verb stack     at _drainQueue (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:131:9)
npm verb stack     at Async._drainQueues (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:147:5)
npm verb stack     at Immediate.Async.drainQueues [as _onImmediate] (/usr/local/lib/node_modules/npm/node_modules/bluebird/js/release/async.js:17:14)
npm verb stack     at runCallback (timers.js:693:18)
npm verb stack     at tryOnImmediate (timers.js:664:5)
npm verb stack     at processImmediate (timers.js:646:5)
npm verb cwd /app
npm verb Linux 4.19.76-linuxkit
npm verb argv "/usr/local/bin/node" "/usr/local/bin/npm" "audit" "-verbose"
npm verb node v10.9.0
npm verb npm  v6.14.5
npm ERR! code ENOAUDIT
npm ERR! audit Your configured registry (https://registry.npmjs.org/) may not support audit requests, or the audit endpoint may be temporarily unavailable.
npm verb exit [ 1, true ]
npm timing npm Completed in 14538ms

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2020-06-02T10_28_58_575Z-debug.log

• The interesting bit is that the audit seems to work partially when you install the dependencies for the first time (npm install):

audited 3417 packages in 64.512s

11 packages are looking for funding
  run `npm fund` for details

found 262293 vulnerabilities (262106 low, 179 moderate, 8 high)
  run `npm audit fix` to fix them, or `npm audit` for details

• Another interesting fact that makes me thing it's related to my specific package-lock.json is that, when I run npm audit in another project (with a more simple dependency tree, there is no 503 error). Is there too many dependencies that the npm audit cannot handle?

Steps to Reproduce

• Have these specific package.json & package-lock.json files:

  • package.json
  • package-lock.json

• Run npm audit (in my case, they are ran inside a Docker container but it's reproductible without)

Expected Behavior

• I expect to have the list of the vulnerabilities over my scanned packages.

References

• Related to https://npm.community/t/running-npm-audit-gives-503-enoaudit-error/5543
• Related to https://npm.community/t/enoaudit-from-registry-npmjs-org-503/4642

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.