[BUG] npm 11 wrongly replace registry base URL in package-lock.json

[lenaing]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Hello,

We have an Artifactory set up on our side, lets say its host is artifactory.example.com.
With a package-lock.json file with references to registry.npmjs.org, when we run an NPM install it fails to replace the base registry URL correctly (missing the artifactory/api/npm/all-npm/ part) :

$ node --version
v24.0.2
$ npm --version
11.3.0
$ npm install --registry=https://artifactory.example.com/artifactory/api/npm/all-npm/
...
npm http fetch GET 404 https://artifactory.example.com/callsites/-/callsites-3.1.0.tgz 825ms (cache skip)
npm http fetch GET 404 https://artifactory.example.com/brace-expansion/-/brace-expansion-2.0.1.tgz 826ms (cache skip)
npm http fetch GET 404 https://artifactory.example.com/ansi-styles/-/ansi-styles-4.3.0.tgz 826ms (cache skip)
npm http fetch GET 404 https://artifactory.example.com/semver/-/semver-6.3.1.tgz 826ms (cache skip)
npm verbose stack HttpErrorGeneral: 404 Not Found - GET https://artifactory.example.com/type-fest/-/type-fest-2.19.0.tgz

Expected Behavior

If we switch back to NPM 10.9.2, the base URL is correctly replaced :

$ node --version
v24.0.2
$ npm --version
10.9.2
$ npm install --registry=https://artifactory.example.com/artifactory/api/npm/all-npm/
...
npm http fetch GET 200 https://artifactory.example.com/artifactory/api/npm/remotes-npm/@babel/core/-/core-7.27.1.tgz 4542ms (cache miss)
npm http fetch GET 200 https://artifactory.example.com/artifactory/api/npm/remotes-npm/yaml/-/yaml-2.8.0.tgz 4740ms (cache miss)
npm http fetch GET 200 https://artifactory.example.com/artifactory/api/npm/remotes-npm/mocha/-/mocha-10.8.2.tgz 4579ms (cache miss)
npm http fetch GET 200 https://artifactory.example.com/artifactory/api/npm/remotes-npm/luxon/-/luxon-3.6.1.tgz 4739ms (cache miss)
...

Steps To Reproduce

$ npm install cowsay

added 41 packages in 2s

3 packages are looking for funding
  run `npm fund` for details

$ rm -Rf node_modules/ .npm/

$ npm install --registry=https://artifactory.example.com/artifactory/api/npm/remotes-npm/
npm error code E404
npm error 404 Not Found - GET https://artifactory.example.com/yargs-parser/-/yargs-parser-18.1.3.tgz
npm error 404
npm error 404  'yargs-parser@https://artifactory.example.com/yargs-parser/-/yargs-parser-18.1.3.tgz' is not in this registry.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.

Environment

• npm: 11.3.0
• Node.js: v24.0.2
• OS Name: AWS Linux 2023 (Docker : Debian 12.11 Bookworm, via node:latest)
• System Model Name: N/A
• npm config:

; node bin location = /usr/local/bin/node
; node version = v24.0.2
; npm local prefix = /
; npm version = 11.3.0
; cwd = /
; HOME = /root
; Run `npm config ls -l` to show all defaults.

[milaninfy]

@lenaing This is fixed on latest npm(11.4.1) by #8222.