Troubleshoot npm download failures on Microsoft's corporate network or VPN using the 1ES public package feed. It covers registry access, approved proxies, and certificate trust, preserving locked dependency versions and reporting network blockers when recovery fails.
Troubleshoot npm registry, proxy, and certificate failures on the Microsoft corporate network or VPN using the 1ES public npm feed.
Review the instructions the agent will receive before you install.
Use this skill when npm downloads are blocked by the Microsoft corporate network or VPN. Run commands in the affected package directory. Prefer npm ci with the existing lockfile and default registry when access works; do not change dependency versions to solve a network failure.
When access to npmjs is blocked, retry through the Microsoft 1ES public feed with command-scoped settings:
registry=https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/
npm ci --registry="$registry" --replace-registry-host=npmjs
--replace-registry-host=npmjs routes npmjs lockfile downloads through the selected registry without rewriting the lockfile. Private registries and lifecycle scripts that download from other hosts still need their own approved network access. Do not edit manifests, lockfile URLs, or committed npm configuration just to work around the local VPN.
To diagnose feed access, query an actual package and exact version from the lockfile. For example, substitute the project's pinned package and version in:
npm view yaml@2.9.0 version --registry="$registry" \
--fetch-retries=0 --fetch-timeout=15000
Use npm view, not npm ping: the feed may not implement the ping endpoint. A successful metadata query checks that package's availability, not tarball or postinstall access. Retry the original install to verify recovery.
If the feed returns an authentication error or lacks the pinned package, report the blocker rather than guessing credentials or trying arbitrary mirrors. Caching an upstream package can require feed permissions.
The feed is an npm registry, not an HTTP proxy. Never set HTTPS_PROXY or HTTP_PROXY to the feed URL. If a forward proxy is required, use only an IT-approved proxy URL in the current shell and check NO_PROXY for unintended bypasses. Do not expose proxy credentials or copy machine-specific configuration into the repository or logs.
For certificate-chain errors, use the approved corporate CA rather than disabling TLS verification:
NODE_USE_SYSTEM_CA=1 so Node uses the system trust store.NODE_EXTRA_CA_CERTS to the path of an IT-provided PEM certificate bundle before starting npm.cafile override is selecting a different CA bundle.Keep HTTPS and TLS verification enabled. Never use strict-ssl=false, NODE_TLS_REJECT_UNAUTHORIZED=0, curl -k, or an HTTP registry, and do not disconnect the VPN or bypass corporate network controls.
For ENOTCONN, connection resets, timeouts, or firewall denials, report the failing hostname and error with secrets redacted. Distinguish registry metadata, package tarball, and lifecycle-script failures. Stop repeated installs once the network blocker is confirmed; do not delete the lockfile or clear caches as a network fix. Escalate to IT for approved HTTPS access to the failing host, including ms-feed-25.pkgs.visualstudio.com when the feed itself is blocked.
Based on the githubnext/gh-aw-cao npm skill, under the repository's MIT license.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Coordinate work across AI agents with shared rules for locating team files, recording decisions and their reasons, and requesting help. It also defines who owns revisions after a reviewer rejects an artifact.
Set shared development rules for an agent team: keep specific agent names out of product code, tests, and CI configuration, verify affected tests before finishing, and record lessons learned from mistakes.
Routes requests to design, create, update, debug, or upgrade GitHub Agentic Workflows to the appropriate instructions. It helps the agent select a workflow-specific procedure and apply any additional rules defined for the repository.
Prepare architecture proposals before implementation so the team can agree on a direction. Organize evidence, technical choices, effects on existing work, risks, and the first release’s scope into a document with clear recommendations and decision owners.
Update the gh-aw-firewall version used by gh-aw, rebuild generated files, and review release notes and configuration schemas, which define valid settings. It guides related code and test updates while identifying follow-up work that remains.
Review git and gh operations in gh-aw workflows to check credential availability for each repository. Identify missing token handoffs, risky expansions of limited checkouts, and error handling needed where credentials are intentionally unavailable.