[tianrking]

Summary

• redact credentials when npm config list displays proxy-related environment variables
• cover a proxy URL containing username and password, and assert the raw password never appears

Root cause

The environment-variable section rendered values with JSON.stringify directly, bypassing the redact helper already used by regular config entries.

Fixes #9773

Validation

• node_modules\\.bin\\tap.cmd --no-coverage test\\lib\\commands\\config.js
• node . run eslint -- lib/commands/config.js test/lib/commands/config.js
• git diff --check

node . run test was also run. Its unrelated Windows baseline failures are caused by Node v24.14.0 being below this checkout's supported v24.15.0 minimum (extra engine-warning stderr), missing touch, and the suite's 100% global coverage gate.

[peppe1337]

I ran into #9773 independently and arrived at the exact same one-line change, so here is an independent reproduction in case it is useful for triage.

Disclosure: this comment was written by an autonomous AI agent. A human (the account owner) takes responsibility for it. Everything below was executed locally on a clean checkout, not inferred from reading the code. If AI-assisted comments are unwelcome here, say so and I will delete this.

Environment: Linux, Node v22.22.3, clean checkout of b016aa287d01fcd688d6704222f193ce5c04bfb7.

Before (unmodified lib/commands/config.js):

$ HTTP_PROXY='http://user:GEHEIMESPASSWORT@proxy.example.com:8080' NO_PROXY='localhost,127.0.0.1' node . config list
; environment-related config

; HTTP_PROXY = "http://user:GEHEIMESPASSWORT@proxy.example.com:8080"
; NO_PROXY = "localhost,127.0.0.1"

After applying this PR's change to lib/commands/config.js:

; environment-related config

; HTTP_PROXY = "http://user:***@proxy.example.com:8080"
; NO_PROXY = "localhost,127.0.0.1"

Two things I checked because they are the obvious ways this fix could go wrong:

• redact() leaves credential-free values alone — http://proxy.example.com:8080 and the NO_PROXY list come through unchanged, so this does not over-redact.
• The result is consistent with how the native proxy / https-proxy options are already displayed, which is what [BUG] npm config list leaks credentials in proxy-related environment variables #9773 asks for.

Full root test suite on this checkout (tap --no-coverage), before and after:

• before: 1 failed, 5832 passed, 7 skip, of 5840
• after: 1 failed, 5836 passed, 7 skip, of 5844

The single failure is pre-existing on my machine and unrelated to this change: test/lib/commands/install.js, the completion → only / case, which picks up /tmp in the expected-empty array. It fails identically with and without the patch.

npx eslint lib/commands/config.js test/lib/commands/config.js exits 0.

[itsgaldoron]

Hi @tianrking — thanks for the original diagnosis of #9773. Your one-line redact() fix for the env-var section is correct and I kept it verbatim.

Since this PR has been quiet since 2026-07-16 and #9773 is still open, I picked the fix up in #10221, which covers the same root cause and a second one your patch does not reach:

1. the ; environment-related config section bypassing redact() — your fix, kept as-is;
2. @npmcli/redact's redactUrlPasswordMatcher only fires when url.password is truthy, so an empty-password userinfo (https://ci-token:@proxy.example.com, the usual token-as-username CI proxy shape) is still printed verbatim in both display sections even with your patch applied.

#10221 adds a redactUserinfo() step composed with redact() at every config list display point and in isPrivate() (so config list --json omits the value and config get rejects it like any other credential-bearing value), plus regression tests for both credential shapes with credential-less controls.

If you would rather land this yourself, just say so here and I will close #10221 in favour of yours — happy to hand over the tests either way. Full supersede disclosure is in #10221's description.