[RRFC] Registry per package on the same organisation

[baloran]

Motivation ("The Why")

We want to install some private package from github registry and some public package from npm registry with the same scope organisation.

Example

My .npmrc ⬇️

@unlikelystudio/simpleql:registry=https://registry.npmjs.org
@unlikelystudio:registry=https://npm.pkg.github.com/

How

Current Behaviour

The SimpleQL package try to be installed from github registry (eg: https://npm.pkg.github.com) instead of npm.

Desired Behaviour

SimpleQL Package use the npm registry and the others github registry.

I have searching arround some solution with git install repository directly but is not very great solution. Here to discuss of solution or pull request I can do.

[wesleytodd]

One new hazard this introduces: in older versions of npm which do not support this feature might result in users installing code from an unexpected registry and therefore opening the door to a RCE or otherwise getting the wrong code. By back porting the feature or atleast an error to npm@6 will help reduce the issue.

Also, will this support unscoped package names? I think it should.

[ruyadorno]

Let's follow up with the conversation in the actual RFC PR #217 😊