Skip to content

fix(config): redact proxy environment credentials#9774

Open
tianrking wants to merge 1 commit into
npm:latestfrom
tianrking:agent/redact-proxy-env-config
Open

fix(config): redact proxy environment credentials#9774
tianrking wants to merge 1 commit into
npm:latestfrom
tianrking:agent/redact-proxy-env-config

Conversation

@tianrking

Copy link
Copy Markdown

Summary

  • redact credentials when npm config list displays proxy-related environment variables
  • cover a proxy URL containing username and password, and assert the raw password never appears

Root cause

The environment-variable section rendered values with JSON.stringify directly, bypassing the redact helper already used by regular config entries.

Fixes #9773

Validation

  • node_modules\\.bin\\tap.cmd --no-coverage test\\lib\\commands\\config.js
  • node . run eslint -- lib/commands/config.js test/lib/commands/config.js
  • git diff --check

node . run test was also run. Its unrelated Windows baseline failures are caused by Node v24.14.0 being below this checkout's supported v24.15.0 minimum (extra engine-warning stderr), missing touch, and the suite's 100% global coverage gate.

@tianrking
tianrking requested review from a team as code owners July 16, 2026 11:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] npm config list leaks credentials in proxy-related environment variables

1 participant