[BUG] `npx` no longer works with `github:` registry

[mike-potter]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When using Node v18.4.0 or later (npm 8.12.1 or later), referencing a Github repo via:

npx github:org/project.git

gives the error:

@org/project@1.0.0' is not in this registry.

In past versions of npx this worked fine and would create a package.json in ~/.npm/_npx/HASH/package.json that contained:

{
  "dependencies": {
    "@org/project": "github:org/project"
  }
}

but in the new versions of npx it seems to be trying to resolve the project in the main npm registry rather than using Github.

I also tried using a full Github URL path instead of just github: and got the same error.

When I look at the nvm log, older versions that worked show:

40 silly idealTree buildDeps
41 silly fetch manifest @org/project@github:org/project
42 silly placeDep ROOT @org/project@1.0.0 OK for:  want: github:org/project
43 timing idealTree:#root Completed in 428ms

but the nvm log for latest version that doesn't work shows:

40 silly idealTree buildDeps
41 silly fetch manifest @org/project@1.0.0
42 http fetch GET 404 https://registry.npmjs.org/@org%2fproject 377ms (cache skip)
43 http fetch GET 404 https://registry.npmjs.org/@org%2fproject 181ms (cache skip)
44 silly placeDep ROOT @org/project@ OK for:  want: 1.0.0
45 timing idealTree:#root Completed in 567ms

Notice how the latest version is trying to use 1.0.0 and registry.npmjs.org instead of github

Expected Behavior

Expected to download the repo package.json and execute a command.

Steps To Reproduce

When using Node v18.4.0 or later (npm 8.12.1 or later)

npx -y github:org/project.git

gives the error:

@org/project@1.0.0' is not in this registry.

(org and project removed for privacy)

Environment

• npm: 8.12.1 or later
• Node.js: 18.4.0 or later
• OS Name: Mac OSX 12.3
• System Model Name: Macbook
• npm config:

; node bin location = /Users/myname/.nvm/versions/node/v18.4.0/bin/node
; node version = v18.4.0
; npm local prefix = /Users/myname/Projects/temp
; npm version = 8.12.1
; cwd = /Users/myname/Projects/temp
; HOME = /Users/myname
; Run `npm config ls -l` to show all defaults.

[mike-potter]

Here is the npm config for node 18.5.0 that has the same problem:

; node bin location = /Users/myname/.nvm/versions/node/v18.5.0/bin/node
; node version = v18.5.0
; npm local prefix = /Users/myname/Projects/temp
; npm version = 8.12.1
; cwd = /Users/myname/Projects/temp
; HOME = /Users/myname
; Run `npm config ls -l` to show all defaults.

the log file has the same references to registry.npmjs.org shown above for 18.4.0

[mike-potter]

And then I force updated npm to the latest version via npm install -g npm@latest and it still failed. Here is that npm config:

; node bin location = /Users/myname/.nvm/versions/node/v18.5.0/bin/node
; node version = v18.5.0
; npm local prefix = /Users/myname/Projects/temp
; npm version = 8.13.2
; cwd = /Users/myname/Projects/temp
; HOME = /Users/myname
; Run `npm config ls -l` to show all defaults.

[mike-potter]

Last known npm version where it was working is 8.11.0

[nlf]

i'm not able to reproduce this one so far:

> npx -y github:npm/cli --version
8.14.0

is this happening for you with any package coming from github, or only some specific subset? does the command that worked for me above work for you?

[cspotcode]

I was seeing that it erroneously tries to talk to npmjs.com when it should be talking to GitHub. I'm guessing if you try to run something off of GitHub, but it's been published to npm, then it'll appear to work while the bug happens behind the scenes. Maybe try with something on GitHub that is known to not exist on npm.

[mike-potter]

The npx -y github:npm/cli --version works for me here. But using a public repo that has never been published to npm does not work. But confirmed works fine in npm 8.11.0, just not in later versions.

[mike-potter]

Confirmed that the test with github:npm/cli doesn't actually pull it from github. The cached package.json in the .npm/_npx folder is:

  "dependencies": {
    "npm": "^8.14.0"
  }
}

and is missing any reference to github.

[wraithgar]

This is the same root cause as #5132, which has already been triaged and prioritized. Closing this as a dupe and making a note there about this issue existing.