npm install batch 401: committed package-lock.json pins resolved URLs to an expired mirror

Context

Deploying the huobao-drama demo (backend + frontend) on a fresh Linux VM: both packages had committed package-lock.json files generated on a machine configured for the Alibaba npm mirror.

Problem

Fresh npm install failed with 401 Unauthorized on dozens of packages. The committed package-lock.json files had resolved fields pointing at an expired Alibaba npm mirror — every install replayed the dead tarball URLs, so nothing could download.

Error (redacted / normalized)

npm error 401 Unauthorized - GET https://<alibaba-mirror-host>/...tgz
(dozens of packages, all tarballs; registry.npmjs.org itself was reachable)

Applies when

Node 24, npm 10+, Linux, Oct 2026. Repo with committed package-lock.json from another environment.

Confirm it is this problem

grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: URLs on the Alibaba mirror host (not registry.npmjs.org). npm install → expect: 401 Unauthorized across many packages. If a fresh npm init project also 401s, that is .npmrc auth config instead — not this problem.

Not this when / boundary

If resolved URLs are already registry.npmjs.org and installs still 401, the mirror is not the cause — check .npmrc auth / token expiry. If only one scoped package 401s, that is a per-package permission problem.

Root cause

package-lock.json pins exact resolved tarball URLs, not just versions. This lockfile was generated against an Alibaba npm mirror; when that mirror expired, every npm install replayed the dead URLs. Retrying or bumping versions cannot help because the resolved field is unchanged by version bumps within the locked range.

Fix

1. Confirm it is this problem: grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: Alibaba mirror URLs
2. Move the poisoned lockfiles aside (backend and frontend): mv package-lock.json package-lock.json.bak
3. Reinstall against the public registry: npm install --registry=https://registry.npmjs.org → expect: completes, fresh lockfile written
4. Verify the fix: grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: registry.npmjs.org URLs only
5. Start the app and hit its health endpoint → expect: 200

How to verify

npm install completes with no 401s and the application starts and answers its health endpoint.

What did not work

Retrying npm install — same 401s, the lockfile replays the same dead URLs. Changing individual package versions — the resolved URL for the new version still pointed at the dead mirror.

Rollback

Restore the .bak lockfiles if the fresh install misbehaves.

Risks

Low. Regenerating the lockfile may bump transitive versions; run the test suite after.

Verified scope

npm 10+, Oct 2026

Becomes obsolete when

When the lockfile's resolved URLs point at a reachable registry; regenerate the lockfile whenever the team's registry changes.