`jf npm` writes legacy `email` and `always-auth` keys into the generated .npmrc — fails with ERR_INVALID_AUTH on npm 12

[andrewshaughnessy-rrd]

Describe the bug

jf npm <install|ci> generates a temporary .npmrc in the working directory that contains the two legacy npm auth keys email and always-auth.

These have been deprecated since npm 9, and npm 11 emitted npm warn Unknown user config ... for both, along with the explicit notice "This will stop working in the next major version of npm."

npm 12 is that next major version. It now rejects them with a hard ERR_INVALID_AUTH, so every jf npm invocation fails before any packages are resolved.

This appears to be leftover from the npm 9 migration. At that time _auth was correctly moved to the per-registry nerfed form — the CLI passes it as an npm_config_//<host>/artifactory/api/npm/<repo>:_auth environment variable, which npm 12 accepts without complaint. But email and always-auth were left in the generated file, where they stayed harmless as warnings until npm 12 promoted them to errors.

Related prior reports of the same class of bug in other JFrog integrations: jfrog/build-info#764, jfrog/jfrog-azure-devops-extension#385, jfrog/jenkins-artifactory-plugin#815.

Current behavior

$ jf npm-config --repo-deploy npm --repo-resolve npm
[Info] npm build config successfully created.

$ jf npm ci ./
{
  "error": {
    "code": "ERR_INVALID_AUTH",
    "summary": "Invalid auth configuration found: `email` must be renamed to `//<host>/artifactory/api/npm/:email` in user config\nPlease run `npm config fix` to repair your configuration.`",
    "detail": ""
  }
}
[Info] Trace ID for JFrog Platform logs: <redacted>
[Error] error while running '/usr/local/bin/npm ci ./': exit status 1
npm error code ERR_INVALID_AUTH
npm error Invalid auth configuration found: `email` must be renamed to `//<host>/artifactory/api/npm/:email` in user config
npm error Please run `npm config fix` to repair your configuration.`

npm config fix is not a usable workaround here: the CLI regenerates the .npmrc on every invocation and removes it on exit, so any repair is overwritten before npm reads it.

Reproduction steps

1. In a container with Node 22 and npm 12.0.1, configure a JFrog server and run jf npm-config --repo-deploy npm --repo-resolve npm.
2. Run jf npm ci ./ in any project. It fails as above.
3. Downgrade to npm 11.18.0 and re-run. It succeeds, but prints:

npm warn Unknown user config "always-auth". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn Unknown user config "email". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.

To see the generated file, put a shim named npm ahead of the real one on PATH that dumps the working directory's .npmrc and exits, then run jf npm ci ./. The captured contents:

always-auth = true
email       = <jfrog account email>
json        = true
registry    = https://<host>/artifactory/api/npm/<repo>

The file exists only for the duration of the npm subprocess — it is not present before or after the run.

Reproduced identically on jf 2.75.1 and jf 2.117.0 (current latest), so this is not fixed on the current release.

Expected behavior

The generated .npmrc should not contain email or always-auth.

• always-auth has no effect on npm 9+ — per-registry credentials are always sent — so it can simply be dropped.
• email is not required for npm authentication against Artifactory. If it must be preserved for some flow, it should be written in the per-registry nerfed form //<host>/artifactory/api/npm/<repo>:email, matching how _auth is already handled.

JFrog CLI version

2.75.1 (also reproduced on 2.117.0)

Operating system type and version

Alpine Linux 3.24.1, Node v22.23.1, npm 12.0.1. Reproduced on both linux/amd64 and linux/arm64.

JFrog Artifactory version

Artifactory Cloud (SaaS)

JFrog Xray version

No response