npm --version takes 3 minutes to complete when run in child process and behind corporate proxy

[n0v1]

I'm opening this issue because:

• npm is crashing.
• npm is producing an incorrect install.
• npm is doing something I don't understand.
• npm is producing incorrect or undesirable behavior.
• Other (see below for feature requests):

What's going wrong?

When we tried to build an Android application using the NativeScript CLI, it took ages. Debugging showed that the process hangs for 3 minutes when trying to get the currently installed npm version in this script.

To get the npm version, NativeScript executes the command npm -v in a child process and waits for the output.

The update check feature that was introduces with npm@4.4.0 does not support proxies and thus prevents the child process from closing until it times out after 3 minutes.

The update check feature uses the update-notifier package that uses the latest-version package which in turn uses package-json. package-json currently does not support proxies and the author seems not to be willing to implement proxy support.

How can the CLI team reproduce the problem?

This repository holds a script to reproduce the problem. The error occurs only when you are behind a corporate proxy and probably only on Windows systems (tested Windows 7 and Windows 10).

Workarounds

See https://github.com/yeoman/update-notifier#user-settings

• Set environment variable NO_UPDATE_NOTIFIER=1
• Use --no-update-notifier flag
• Set "optOut": true in ~/.config/configstore/update-notifier-[your-module-name].json

Possible solutions

• Skip update check if a proxy is used (check if proxy variables are set in npm config?)
• Implement a (short) timeout for the proxy check and kill the child process after that (would have to be implemented in update-notifier package
• Use another module for the update check that has proxy support
• Use another method to get the latest npm version from the registry that relies on the npm proxy configuration (npm outdated, npm view)

Related issues

• Node.js processes dose not close down after a npm command is done #19756
• any npm command start node with update-notifier that lock the current folder #20273
• config: Enable config for suppressing update-notifier #20750
• Spawn-ed detached unref-ed child process in Windows still prevents parent from exit nodejs/node#5614
• update-notifier creates lots of troubles yeoman/update-notifier#140
• Stalled / orphaned processes when offline yeoman/update-notifier#115
• Support HTTP_PROXY / HTTPS_PROXY use with "got" package sindresorhus/package-json#22

supporting information:

• npm -v prints: 5.6.0
• node -v prints: 8.11.1
• npm config get registry prints: https://registry.npmjs.org/
• Windows, OS X/macOS, or Linux?: Windows 7
• Network issues:
  • Geographic location where npm was run: Germany
  • I use a proxy to connect to the npm registry.
  • I use a proxy to connect to the web.
  • I use a proxy when downloading Git repos.
  • I access the npm registry via a VPN
  • I don't use a proxy, but have limited or unreliable internet access.
• Container:
  • I develop using Vagrant on Windows.
  • I develop using Vagrant on OS X or Linux.
  • I develop / deploy using Docker.
  • I deploy to a PaaS (Triton, Heroku).