[BUG] `npm config` permanently expands environment variables in .npmrc

[adam-nielsen]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Running npm config set expands all environment variables in .npmrc, permanently.

The documentation says you can do this:

All npm config files are an ini-formatted list of key = value parameters. Environment variables can be replaced using ${VARIABLE_NAME}. For example:

prefix = ${HOME}/.npm-packages

However if you do this, it gets expanded permanently the first time you run npm config:

$ cat .npmrc
prefix = ${HOME}/.npm-packages
$ npm config set dummy=true --location=project
$ cat .npmrc
prefix = /home/example/.npm-packages
dummy=true

Expected Behavior

Environment variables in .npmrc should be left alone. They are often placeholders for things like authentication tokens for private repositories, so replacing them with the current value is undesirable and breaks functionality.

Steps To Reproduce

1. echo 'prefix = ${HOME}/.npm-packages' >> .npmrc
2. cat .npmrc
3. Confirm ${HOME} is contained in the file
4. npm config set dummy=true --location=project
5. cat .npmrc
6. Observe ${HOME} has been replaced with the current user's actual home directory.

Environment

• npm: 8.18.0
• Node.js: 18.4.0
• OS Name: Arch Linux

[wraithgar]

Duplicate of #5267