[toufiq-dev]

What:

When an E401 (Basic realm) auth error comes from a private registry, the error message still pointed users at https://www.npmjs.com/forgot, which is the wrong site entirely for Artifactory / GitHub Packages / Verdaccio / Nexus users. This changes the message to point at the root of the configured registry, and keeps https://www.npmjs.com/forgot for the default registry or when config is not loaded.

Why:

Fixes #10014 — teams on internal mirrors see recovery instructions for the public npm registry, which is confusing during auth incidents.

How:

• In lib/utils/error-message.js (Basic-realm branch), read npm.config.get('registry') when npm?.loaded (the error handler can render before npm.load completes, and tests may invoke errorMessage without npm, so this degrades safely to the current URL).
• Strip trailing slashes to render the registry root (custom registries have no /forgot page, as noted in the issue).
• Default-registry runs (https://registry.npmjs.org/) keep the existing https://www.npmjs.com/forgot link, so no behavior change for the default case.

Tests:

• New: 401 Basic with a custom registry configured → message contains the registry root, not npmjs.com/forgot.
• New: npm not loaded ({ loaded: false }) → no throw, keeps the npmjs.com fallback.
• Existing snapshot for the default-registry Basic case is unchanged (it already shows npmjs.com/forgot, which remains correct).

All 146 assertions in test/lib/utils/error-message.js pass; eslint clean.

New output for a private registry:

npm error Please try again, or recover your password at:
npm error   https://artifactory.mydomain.com/artifactory/api/npm/my-npm-mirror

[toufiq-dev]

Hi 👋 Friendly follow-up on this — it fixes #10014 (the E401 password-recovery link pointing at npmjs.com for private-registry users). It's mergeable and untouched on my end since opening.

I noticed CI hasn't run on the fork branch yet — if that's the first-time-contributor workflow approval, no stress, just flagging it in case someone with permissions wants to trigger the checks.

Happy to make any changes to the message wording or fallback behavior — for example, if pointing at the registry root isn't the right recovery path for all private registries, I'm glad to adjust. Thanks!

[toufiq-dev]

Hi 👋 One more (and last) nudge on this — it fixes #10014 and I understand review bandwidth is tight. It's ~4 weeks old now and I noticed the mergeability is being recomputed, so the base may have drifted from latest. If it helps, I've already rebased once before and I'm happy to do it again on request — or feel free to just leave it in the backlog if that's the review flow here. Either way, thanks for the consideration 🙏