npm audit fails with 500 server error on nightly build

Your Environment

• verdaccio version: v6.0.0-6-next.17
• node version: 14.17.2 & 16.3.0 locally, 14.16.1 inside of the container
• package manager: npm@6 & npm@7
• os: linux
• platform: docker (nightly-master@f48b67b2111e)

Describe the bug

npm audit fails with 500 Internal Server Error.

npm 7.19.1 & node 16.3.0:

npm 6.14.13 & node 14.17.2`:

Container logs:

To Reproduce

docker run --rm -p 4873:4873 --name verdaccio -d verdaccio/verdaccio:nightly-master@sha256:f48b67b2111e90eacb030c40d89e677e3aab60ce807b041aa8cf1f39af39d0bb
mkdir verdaccio-audit-test
cd verdaccio-audit-test
npm init -y
echo 'registry=http://localhost:4873' >> .npmrc
npm install lodash
npm audit

Expected behavior

npm audit should work.

Screenshots, server logs, package manager log

See above.

Configuration File (cat ~/.config/verdaccio/config.yaml)

Default docker image configuration.

Environment information

Environment Info:
  System:
    OS: Linux 5.8 Alpine Linux undefined
    CPU: (16) x64 AMD Ryzen 7 1700 Eight-Core Processor
  Binaries:
    npm: 6.14.12 - /usr/local/bin/npm

Debugging output

See logs above (I couldn’t get the extensive logging output to work, sorry).

• $ npm config get registry prints: http://localhost:4873/

Contribute to Verdaccio

• I’m willing to fix this bug 🥇

[simon-lorenz]

I poked around a little bit and found that this line should be headers.host = 'registry.npmjs.org' without https://. After that, the ssl error disappears, but a 400 client error is returned instead. I don’t know how to debug any further at this point.

Also, I think the plugin ssl configuration is not respected because this if condition always fails if config.strict_ssl is false and therefore no https agent with rejectUnauthorized: false can be created.

[DanielRuf]

See also https://verdaccio.org/docs/en/configuration#audit