[BUG] npm login does not accept email address as an username for custom registries

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

npm login --scope ORG --registry https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/REPO/npm/registry/
username: NAME.SURNAME@ORG.com
npm warn Name may not contain non-url-safe chars
username: <cursor awaiting for input, without @ sign>

Expected Behavior

I can login with whatever username format my org registry supports.

I understand the requirement for protecting npm registry from invalid usernames, but it shouldn't apply to custom registries by default, which most likely follow different rules and separate, scoped organization-level registry maintenance support.

Out of scope

Yet they'd be welcome warmly.

• Create a custom username/credentials ruleset config for custom registires (like change validation regex)
• Allow to toggle username ruleset on/off by flags/config for custom registries

Workaround

You can edit glabal .npmrc with an text editor and type your email there as is for the username. Then npm can fetch the package normally.

https://learn.microsoft.com/en-us/azure/devops/artifacts/npm/npmrc?view=azure-devops&tabs=other#setup-credentials

Steps To Reproduce

1. Let say you have a registry on AzureDevops like https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/REPO/npm/registry/ that expects your username to be an Azure DevOps email like NAME.SURNAME@ORG.com and a password in form of Azure DevOps PAT token.
2. With empty .npmrc
3. Run npm login --scope ORG --registry https://pkgs.dev.azure.com/ORG/PROJECT/_packaging/REPO/npm/registry/
4. Enter your username as NAME.SURNAME@ORG.com
5. See a warning npm warn Name may not contain non-url-safe chars that blocks you from proceeding to the next login step...

Environment

• npm: 12.0.2
• Node.js: 24.19.0
• OS Name: Windows + Ubuntu (WSL) (issue happens on both host and guest OS)
• System Model Name: Thinkpad Lenovo
• npm config:

// empty as I try to login

Start with the npm login command and reproduce the behavior using the Azure DevOps registry URL and an empty .npmrc. The payload names no source files or tests; done means a custom-registry login accepts the documented email-style username without blocking, while the listed ruleset and configuration ideas remain out of scope.