npm / npm/cli

[BUG] Using `--install-strategy = "linked"` ignores the `strict-ssl` config

Open
#8,340 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

Running npm i with the following configuration:

Global configuration since we're running behind a restrictive firewall:

npm config set strict-ssl false

Config file in our project .npmrc:

install-strategy = "linked"

The command output gives us a c:

npm error: Error: self-signed certificate in certificate chain
///
npm error:  code: 'SELF_SIGNED_CERT_IN_CHAIN'

Running the install script using the default strategy works fine (no cert error)

Expected Behavior

The strict-ssl config param should work the same way no matter which install-strategy is selected

Steps To Reproduce
  1. Install packages with self-signed cetificates
  2. Set strict-ssl to false
  3. Set install-strategy to linked
  4. Run npm install
  5. Get error SELF_SIGNED_CERT_IN_CHAIN
Environment
  • npm: 11.4.1
  • Node.js: 20.18.1
  • OS Name: Windows 11
  • npm config:
cafile = // File path
prefix = // Appdata path
registry = // Company registry
strict-ssl = false
unsafe-perm = true

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the installation with a project .npmrc containing install-strategy="linked" and strict-ssl=false, then compare it with the default strategy. Trace the linked installation path and verify that npm install accepts the self-signed certificate when strict-ssl is disabled, while preserving the existing default-strategy behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.