Npmrc Credential Scope Auditor

How to use Npmrc Credential Scope Auditor

Review one local flat npmrc for credential URI scopes, shadowed assignments and environment reference names while omitting credential values. Find unscoped authentication settings and source lines that replace earlier exact keys. Registry entries expose only a parsed origin; this audit never expands your environment, reads certificate paths or contacts a registry.

1. Provide optional local flat npmrc file, one flat npmrc source.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• One UTF-8 source up to 100 KB, 2,000 physical LF/CRLF lines, 500 assignments and 8,192 characters per line. No BOM, bare CR, prohibited controls, INI sections, array keys, quoted/escaped keys, whitespace/comment characters inside keys or prototype-related bare keys. Each assignment needs a nonempty key followed by =.
• Value decoding uses the installed npm/ini 7 parser for this declared flat profile. Full npm CLI validation, command-line/user/global/default precedence and filesystem discovery are not performed. Unknown options and differently cased credential spellings remain explicitly unmodeled.
• The selected credential names are _auth, _authToken, username, _password, email, cafile, certfile and keyfile. The audit shows a supplied URI-fragment scope or an explicit diagnostic; that is source evidence, not proof a client would send a valid credential to a registry.
• Scope keys are bounded //host[/path]: fragments without userinfo, query, fragment, percent or backslash spelling. The reported path retains its exact source spelling; this is not a complete npm request-routing model. Registry values may show only a parsed HTTP(S) origin; credential-bearing/unsupported URLs and unresolved environment values receive generic codes.
• Every assignment value is omitted except an allowed noncredential registry origin. No credential value, decoded password, file path, raw line, comment or parser error excerpt is returned. Unsupported/unmodeled URI-scoped key spellings are masked as well, so malformed userinfo/path data cannot leak through a displayed key. Duplicate and invalid-input diagnostics contain line numbers and fixed codes/messages. Input remains visible in your local form until you clear it.
• Environment placeholders expose at most 32 distinct names per assignment, using bounded ASCII variable identifiers and optional ?. No environment variable is read, substituted or tested for existence. Exact duplicate keys select the last assignment in this one file and keep line witnesses for the shadowed entry.
• A dedicated Worker loads the INI module before ready, with a 10-second preparation deadline and a separate 2-second computation limit. No registry, user file, certificate, key path or npm command is accessed.
• The formatted report is limited to 500,000 characters. Reduce the source when that output budget is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.