npm auth token used on private repo for scoped packages

[cburgmer]

Do you want to request a feature or report a bug?

bug

What is the current behavior?

$ cat .yarnrc
registry "http://example.com/nexus/repository/npm-repositories"
$ cat ~/.npmrc
//registry.npmjs.org/:_authToken=xxxxxxx
$ yarn --verbose
yarn install v0.21.3
verbose 0.232 current time: 2017-03-19T20:32:51.471Z
info No lockfile found.
[1/4] 🔍  Resolving packages...
verbose 0.468 Performing "GET" request to "http://example.com/nexus/repository/npm-repositories/@types%2fnode".
verbose 0.863 Request "http://example.com/nexus/repository/npm-repositories/@types%2fnode" finished with status code 401.
verbose 0.864 Error: Couldn't find package "@types/node" on the "npm" registry.
    at /usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/lib/resolvers/registries/npm-resolver.js:209:15
    at Generator.next (<anonymous>)
    at step (/usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /usr/local/Cellar/yarn/0.21.3/libexec/lib/node_modules/yarn/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:13
    at process._tickCallback (internal/process/next_tick.js:109:7)
error Couldn't find package "@types/node" on the "npm" registry.
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
$ curl -v http://example.com/nexus/repository/npm-repositories/@types%2fnode > /dev/null 2>&1 | grep HTTP
> GET /nexus/repository/npm-repositories/@types%2fnode HTTP/1.1
< HTTP/1.1 200 OK
$ mv ~/.npmrc ~/.npmrc_original
$ yarn
[...]
✨  Done in 2.98s

(Host name and auth token replaced with dummy for privacy reasons.)

If the current behavior is a bug, please provide the steps to reproduce.

See above.

What is the expected behavior?

Do not use npm's auth token on a private repository for scoped packages.

Please mention your node.js, yarn and operating system version.

$ node --version
v7.7.3
$ yarn --version
0.21.3

[cburgmer]

Looks somewhat connected to #2151.

[danez]

This is fixed by #3231 in 0.26.0