[Security] Show registry URL before "npm login" credentials are entered

[rykov]

Problem:

It is opaque which service will receive credentials for "npm login". This can lead to leaked credentials.

Logging into a non-standard registry is a 2-command process. Not only that, but one can be logged into multiple registries for various scopes. Give a multitude of registries, when I perform "npm login", depending on the flags, my credentials can be sent to a number of services. It would be nice to know exactly which one before credentials are entered.

Solution:

Currently:

$ npm config set registry https://npm.fury.io/USERNAME/
$ npm login
Username: <user>
Password: <pass>
Email: (this IS public) <email>
Logged in as <user> on https://npm.fury.io/USERNAME/.

Proposed:

$ npm config set registry https://npm.fury.io/USERNAME/
$ npm login
Log in on https://npm.fury.io/USERNAME/
Username: <user>
Password: <pass>
Email: (this IS public) <email>
Logged in as <user> on https://npm.fury.io/USERNAME/.

[ruyadorno]

Hi @rykov 😊 Thanks for the suggestion!

We discussed it briefly during our OpenRFC meeting today and the consensus is that this is a very nice to have addition and one that is small enough to not warrant a full RFC, I've opened an issue in the cli repo so that we can track the working item in our backlog but it may also be contributed by the community: npm/cli#2071