Artifact update problem: "Failed to replace env in config: ${NPM_TOKEN}".

[cmschuetz]

What Renovate type are you using?
Renovate GitHub App

Describe the bug

All pull requests fail with error message: Artifact update problem.
Possibly related to https://github.com/renovatebot/renovate/issues/3512

Did you see anything helpful in debug logs?

Yes, here is an example failure snippet:

 "stderr": "error An unexpected error occurred: \"Failed to replace env in config: ${NPM_TOKEN}\".\n",
    "message": "Command failed: node /home/ubuntu/renovateapp/node_modules/yarn/bin/yarn.js install --ignore-scripts --ignore-engines --ignore-platform --mutex network:31879\nerror An unexpected error occurred: \"Failed to replace env in config: ${NPM_TOKEN}\".\n `node /home/ubuntu/renovateapp/node_modules/yarn/bin/yarn.js install --ignore-scripts --ignore-engines --ignore-platform --mutex network:31879` (exited with error code 1)",
    "stack": "ChildProcessError: Command failed: node /home/ubuntu/renovateapp/node_modules/yarn/bin/yarn.js install --ignore-scripts --ignore-engines --ignore-platform --mutex network:31879\nerror An unexpected error occurred: \"Failed to replace env in config: ${NPM_TOKEN}\".\n `node /home/ubuntu/renovateapp/node_modules/yarn/bin/yarn.js install --ignore-scripts --ignore-engines --ignore-platform --mutex network:31879` (exited with error code 1)\n    at callback (/home/ubuntu/renovateapp/node_modules/child-process-promise/lib/index.js:33:27)\n    at ChildProcess.exithandler (child_process.js:301:5)\n    at ChildProcess.emit (events.js:182:13)\n    at ChildProcess.EventEmitter.emit (domain.js:441:20)\n    at maybeClose (internal/child_process.js:962:16)\n    at Process.ChildProcess._handle.onexit (internal/child_process.js:251:5)"

To Reproduce
Steps to reproduce the behavior:

1. Create repository with an .npmrc using the structure below
2. Add renovate as a member of said private npm org

Expected behavior
Pull requests should get generated successfully

Screenshots

Additional context

• Renovate is a member of our private org
• We use an .npmrc that look like this:

//registry.npmjs.org/:_authToken=${NPM_TOKEN}
@PRIVATE_ORG:registry=https://registry.npmjs.org/

[rarkins]

You can either remove the file from the repo or else add ignoreNpmrcFile=true in your Renovate config. Please post any follow up questions to the config-help repo

Note: you may need to manually request the rebase/retry checkbox in each PR after your config update, if you don't have automatic rebasing enabled