npm config set accepts and persists invalid values, but later silently ignores them.
Reproduction:
node bin/npm-cli.js config set registry=not-a-url
node bin/npm-cli.js config set fetch-retries=abc
node bin/npm-cli.js config set fetch-timeout=-1
Observed behavior:
- Invalid values are written to ~/.npmrc
- npm prints warnings but exits successfully
- At runtime, npm silently omits the invalid config:
"npm warn config omitting invalid config values"
This leaves users in a confusing state:
- Config appears set
- npm later ignores it without failing
- No clear remediation path
Expected behavior (one of):
- Reject invalid values and do not persist
- Fail with non-zero exit
- Explicitly remove invalid entries
- Require validation before writing to .npmrc
Current behavior silently corrupts config state and makes debugging difficult.