-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Closed
Labels
Enhancementnew feature or improvementnew feature or improvementGood First Issuegood issue or PR for newcomersgood issue or PR for newcomersRelease 7.xwork is associated with a specific npm 7 releasework is associated with a specific npm 7 release
Milestone
Description
Problem:
It is opaque which service will receive credentials for "npm login". This can lead to leaked credentials.
Logging into a non-standard registry is a 2-command process. Not only that, but one can be logged into multiple registries for various scopes. Give a multitude of registries, when I perform "npm login", depending on the flags, my credentials can be sent to a number of services. It would be nice to know exactly which one before credentials are entered.
Solution:
Currently:
$ npm config set registry https://npm.fury.io/USERNAME/
$ npm login
Username: <user>
Password: <pass>
Email: (this IS public) <email>
Logged in as <user> on https://npm.fury.io/USERNAME/.
Proposed:
$ npm config set registry https://npm.fury.io/USERNAME/
$ npm login
Log in on https://npm.fury.io/USERNAME/
Username: <user>
Password: <pass>
Email: (this IS public) <email>
Logged in as <user> on https://npm.fury.io/USERNAME/.
Metadata
Metadata
Assignees
Labels
Enhancementnew feature or improvementnew feature or improvementGood First Issuegood issue or PR for newcomersgood issue or PR for newcomersRelease 7.xwork is associated with a specific npm 7 releasework is associated with a specific npm 7 release