pacote: decode password before passing it on

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/config/pacote.js b/lib/config/pacote.js
index 42a98b7d2..43c5300fc 100644
--- a/lib/config/pacote.js
+++ b/lib/config/pacote.js
@@ -1,6 +1,7 @@
 'use strict'
 
 const BB = require('bluebird')
+const Buffer = require('safe-buffer').Buffer
 
 const cp = require('child_process')
 const npm = require('../npm')
@@ -60,7 +61,10 @@ function pacoteOpts (moreOpts) {
       if (key === '_authToken') {
         opts.auth[nerfDart].token = val
       } else if (key.match(/password$/i)) {
-        opts.auth[nerfDart].password = val
+        opts.auth[nerfDart].password =
+        // the config file stores password auth already-encoded. pacote expects
+        // the actual username/password pair.
+        Buffer.from(val, 'base64').toString('utf8')
       } else if (key === 'always-auth') {
         opts.auth[nerfDart].alwaysAuth = val
       } else {