[ui5/cli] npm-shrinkwrap.json causing registry in .npmrc to be ignored

Expected Behavior

Setting registry value in the .npmrc file should allow node modules to be downloaded from a private registry.

Current Behavior

ui5/cli itself comes from the registry mentioned in .npmrc but the dependency of ui5/cli comes from open source npmjs.org

Steps to Reproduce the Issue

1. Set private registry in .npmrc
2. Set package-lock as true in .npmrc
3. Do npm i
4. Check registry link in package-lock.json for ui5/cli dependencies.

Possible reason:

npm-shrinkwrap.json is present when ui5/cli is installed, as this has resolution links set as npmjs.org the registry in the .npmrc is ignored while fetching the dependencies of ui5/cli.

[tobiasso85]

Are only @ui5-scoped packages affected or also others?

Also others: dependencies > @ui5/cli > dependencies

				"JSONStream": {
					"version": "1.3.5",
					"resolved": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.5.tgz",

But only dependencies of @ui5/cli

[RandomByte]

I’m closing this issue since this is rather a feature request for the npm CLI.

Currently I don’t see anything we can do without loosing the benefits of the shrinkwrap file for our project.