Private npm registry authentication issue on yarn.lock and package.json semver mismatch

[malliapi]

Do you want to request a feature or report a bug?
BUG

What is the current behavior?
Yarn does not authenticate with the private npm registry when the package.json and yarn.lock have a semver mismatch for a spesific package.

For example:
yarn add css-hot-loader
edit package.json and remove the carrot (^) from the version
yarn install
Result: Rejected 401, Unauthenticated

OS: Linux, Ubuntu (Heroku)

[malliapi]

I am opening this issue as the error is misleading. Yarn version 1.3.2, private npm registry: artifactory

[torifat]

Seems like a good candidate for getting started. Feel free to create a PR with better error message 👍

[07Gond]

Hi!
@malliapi @torifat
I just tried to replicate this error on my MacBook using Verdaccio but I couldn't.
Are there some more steps to replicate this behavior?