[BUG] Bad resolution of dependencies of GitHub Packages

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I have a NPM package that has a dependency on a github package.

Package: https://www.npmjs.com/package/d2i-reader
Dependency: https://github.com/argus-inc/fluct

When I do npm install

The command line tries to install the depency that the github package has on github as well.

npm ERR! npm WARN using --force Recommended protections disabled.
npm ERR! npm WARN registry No auth for URI, but auth present for scoped registry.
npm ERR! npm WARN registry 
npm ERR! npm WARN registry URI: https://npm.pkg.github.com/argus-inc/@types/node/-/node-14.0.13.tgz
npm ERR! npm WARN registry Scoped Registry Key: //registry.npmjs.org/
npm ERR! npm WARN registry 
npm ERR! npm WARN registry More info here: https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry
npm ERR! npm ERR! code E403
npm ERR! npm ERR! 403 403 Forbidden - GET https://npm.pkg.github.com/argus-inc/@types/node/-/node-14.0.13.tgz - Permission denied
npm ERR! npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! npm ERR! 403 on a server you do not have access to.

As you can see it is trying to resolve the @types/node package from the same org instead of npm.

Here is the package.json referencing the @types/node: https://github.com/argus-inc/fluct/blob/master/package.json

Expected Behavior

The behavior should work similarly to yarn install where when I install my package it finds the dependency in my org and the the node types in npm.

Steps To Reproduce

1. npm install d2i-reader
2. See error

npm ERR! npm WARN using --force Recommended protections disabled.
npm ERR! npm WARN registry No auth for URI, but auth present for scoped registry.
npm ERR! npm WARN registry 
npm ERR! npm WARN registry URI: https://npm.pkg.github.com/argus-inc/@types/node/-/node-14.0.13.tgz
npm ERR! npm WARN registry Scoped Registry Key: //registry.npmjs.org/
npm ERR! npm WARN registry 
npm ERR! npm WARN registry More info here: https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry
npm ERR! npm ERR! code E403
npm ERR! npm ERR! 403 403 Forbidden - GET https://npm.pkg.github.com/argus-inc/@types/node/-/node-14.0.13.tgz - Permission denied
npm ERR! npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! npm ERR! 403 on a server you do not have access to.

Environment

• npm: 9.6.7
• Node.js: 16.15.1
• OS Name: Mac (also happens on windows 10)
• System Model Name: Ventura
• npm config:

; "user" config from /Users/kuhaku/.npmrc

//registry.npmjs.org/:_authToken = (protected) 

; node bin location = /Users/xxx/.nvm/versions/node/v16.15.1/bin/node
; node version = v16.15.1
; npm local prefix = /Users/xxx/Personal/journey
; npm version = 9.6.7
; cwd = /Users/xxx/Personal/journey
; HOME = /Users/xxx
; Run `npm config ls -l` to show all defaults.

Start by reproducing npm install d2i-reader with npm 9.6.7 and inspect how the GitHub dependency resolves @types/node from the package.json linked in the report. Compare the registry selection with the expected Yarn behavior; done means the GitHub package is resolved while @types/node is fetched from npm without the 403 error.