[BUG] 🐛 "require('fs').writeFileSync()" causes npm publish failure with vague E403 error

[rivy]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

OS name: WinOS
OS version: Microsoft Windows [Version 10.0.19044.2486]
node v18.6.0
npm v9.3.0

I ran into an ugly bug when trying to publish some packages over the weekend. With a horribly vague error message, it was quite a task to determine the actual problem. After much churn, here's the simple reproducible case I was able to generate:

• package.json

{
  "name": "@rivy-labs/-x-8ff8f63d-6ef9-44ee-999b-fc9edf489c98-basic",
  "version": "2.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "require('fs').writeFileSync()"
  },
  "author": "Roy Ivy III <rivy.dev@gmail.com> (https://rivy.dev/)",
  "license": "MIT"
}

npm publish fails with this vaguely horrifying message:

npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://registry.npmjs.org/@rivy-labs%2f-x-npm_***-basic
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

Expected Behavior

npm publish succeeds.

Steps To Reproduce

• Create a new package with npm init
  • npm publish will succeed (ie, https://www.npmjs.com/package/@rivy-labs/-x-8ff8f63d-6ef9-44ee-999b-fc9edf489c98-basic)
• Change the "test" script text to "require('fs').writeFileSync()"
  • npm publish fails with E403...

Environment

• OS Name: Windows

[fritzy]

Sounds like it's failing validation by the registry itself.

Closing: this looks to be an issue with the registry which is outside the scope of this repo. For registry support please go to npmjs.com/support. If you believe this is a bug with the cli, please provide further clarifying details.

[rivy]

@fritzy , I've found, simplified, presented, and, finally, worked around the problem.
I don't see a need to go through a "Contact Us" queue.
I'll just leave it to your organization from this point.