For security reasons, this GitHub Action does not write your NPM auth token to the ~/.npmrc file like some other GitHub Actions do. Instead, it writes an environment variable placeholder named INPUT_TOKEN.

However, the bug that you've discovered is that this action leaves that placeholder in your ~/.npmrc file even after the publish step has finished. In many workflows this is fine, since the publish step is the final step of the workflow. But in your case, you're using the cache action as well, and I believe that action is caching the ~/.npmrc file, which results in subsequent runs of your workflow failing because the ~/.npmrc file references a non-existent environment variable named INPUT_TOKEN.

Ultimately, this is a bug 🐛 in this GitHub Action. It should restore the ~/.npmrc file to its original state after running. But, in the meantime, there are a couple workarounds you could use:

Workarounds

1. Define an environment variable named INPUT_TOKEN in your workflow.

-- OR --

2. Remove the cache action from your workflow, so each build starts with a fresh state

I am also getting the same problem when writing any command related to npm. So I solved by node or nodemon. so when you want to start your server use the node and when you want to install any package just remove this and then install it will work.

//registry.npmjs.org/:_authToken=${INPUT_TOKEN}
It will work in both react and node.js for me. Run react also by node by creating own server.js file like in node.js By this, I successfully deployed my application on Heroku.
And in production give your env variable on the server where your are deploying and in your own machine put it in .bash_profile and put it in .gitignore

I am also getting this problem but I find a solution when I am pushing my repo on Heroku so I notice that Heroku run the command react-script start or build

//registry.npmjs.org/:_authToken=${INPUT_TOKEN}
so this syntax didn't give the error but when I use the same syntax in my system and run the command it gives me.
Because usually when we run in our system we use cmd npm or yarn but if you use react-script then it will not gives an error

as @JamesMessinger say this definitely a bug 🐛

was able to fix this by setting up the ~/.npmrc file and defining INPUT_TOKEN in the job:

jobs:
  build_test_deploy:
    env:
      INPUT_TOKEN: ${{ secrets.NPM_TOKEN }}

- name: 🔧 Setup .npmrc file for publish
  uses: actions/setup-node@v2
  with:
    node-version: ${{ matrix.node-version }}
    registry-url: 'https://registry.npmjs.org'

you can also replace the INPUT_TOKEN with your own GitHub generated personal token

This would be great it if it was documented, I was bashing my head as to why npm dist-tags commands after this publish action weren't working with NODE_AUTH_TOKEN as set by setup-node until I realised this uses a different envvar name. Maybe instead you could align it with setup-node to NODE_AUTH_TOKEN andpartially prevent this unexpected behaviour

Related fix https://github.com/matrix-org/matrix-js-sdk/pull/2717/files