npm install batch 401: committed package-lock.json pins resolved URLs to an expired mirror

发生场景

Deploying the huobao-drama demo (backend + frontend) on a fresh Linux VM: both packages had committed package-lock.json files generated on a machine configured for the Alibaba npm mirror.

问题

Fresh npm install failed with 401 Unauthorized on dozens of packages. The committed package-lock.json files had resolved fields pointing at an expired Alibaba npm mirror — every install replayed the dead tarball URLs, so nothing could download.

报错原文（已脱敏/规范化）

npm error 401 Unauthorized - GET https://<alibaba-mirror-host>/...tgz
(dozens of packages, all tarballs; registry.npmjs.org itself was reachable)

适用环境

Node 24, npm 10+, Linux, Oct 2026. Repo with committed package-lock.json from another environment.

如何确认是这个问题

grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: URLs on the Alibaba mirror host (not registry.npmjs.org). npm install → expect: 401 Unauthorized across many packages. If a fresh npm init project also 401s, that is .npmrc auth config instead — not this problem.

不是这个问题时 / 边界

If resolved URLs are already registry.npmjs.org and installs still 401, the mirror is not the cause — check .npmrc auth / token expiry. If only one scoped package 401s, that is a per-package permission problem.

根因

package-lock.json pins exact resolved tarball URLs, not just versions. This lockfile was generated against an Alibaba npm mirror; when that mirror expired, every npm install replayed the dead URLs. Retrying or bumping versions cannot help because the resolved field is unchanged by version bumps within the locked range.

修复步骤

1. Confirm it is this problem: grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: Alibaba mirror URLs
2. Move the poisoned lockfiles aside (backend and frontend): mv package-lock.json package-lock.json.bak
3. Reinstall against the public registry: npm install --registry=https://registry.npmjs.org → expect: completes, fresh lockfile written
4. Verify the fix: grep -o '"resolved":[^,]*' package-lock.json | sort -u → expect: registry.npmjs.org URLs only
5. Start the app and hit its health endpoint → expect: 200

如何验证

npm install completes with no 401s and the application starts and answers its health endpoint.

试过没用的办法

Retrying npm install — same 401s, the lockfile replays the same dead URLs. Changing individual package versions — the resolved URL for the new version still pointed at the dead mirror.

如何回滚

Restore the .bak lockfiles if the fresh install misbehaves.

风险提示

Low. Regenerating the lockfile may bump transitive versions; run the test suite after.

验证范围

npm 10+, Oct 2026

何时失效

When the lockfile's resolved URLs point at a reachable registry; regenerate the lockfile whenever the team's registry changes.