[SOLVED] NPM - Questions about `Email: (this IS public)`

NPM - Questions about `Email: (this IS public)`

I've configured the email address on npmjs.com, why does the cli keep prompting me to enter email?

$ npm login
npm notice Log in on https://registry.npmjs.org/
Username: wenfangdu
Password:
Email: (this IS public)

Even if I enter a wrong email that is different from the one I set on npmjs.com, I can still log in.

Questions:

What's the point of entering this email?
Can it default to the email address I set on npmjs.com if I don't enter this field?

Solution

This is an artifact of a time when logging in and creating a user were the same request. That's no longer the case, so the email field is ignored unless logging in as the given user with the given password fails with an error indicating that the user does not exist. If that happens npm instead sends a request to create the given user and associate it with the given email.

It's technical debt that the npm team is aware of, it's due to login actually being an alias for adduser. Unfortunately changing this behavior would be a breaking change and require a semver-major version bump, so we won't see this until npm 8.