[BUG] npm config silently ignores values that start with a dash

[gizero]

Current Behavior:

Given a config command like this:

npm config set '//web.archive.org/web/20250502010157/https://gitlab.vendor.com/api/v4/packages/npm/:_authToken' "-iF_9eLYJkB2a3simuB1"

It silently fails to set the configuration key. The command returns 0 while the key turns out to be empty in .npmrc.
My suspect is that -iF_9eLYJkB2a3simuB1 ends up being considered a command line option instead of a positional argument. This is somewhat confirmed by explicitly using -- to tell npm not to search for more options, which brings the expected behaviour back. Another workaround is to use the (apparently undocumented) syntax:

npm config set "//gitlab.vendor.com/api/v4/packages/npm/:_authToken=-iF_9eLYJkB2a3simuB1"

Still, IMO, silently ignoring the value is not the correct behaviour. We should probably at least complain about an invalid option instead.

Expected Behavior:

Either the configuration key is correctly assigned the given value, or the command fails due to an invalid -iF_9eLYJkB2a3simuB1 option.

Steps To Reproduce:

ex. steps to reproduce the behavior:

1. with npm v6, v7, or latest
2. run npm config set '//web.archive.org/web/20250502010157/https://gitlab.vendor.com/api/v4/packages/npm/:_authToken' "-iF_9eLYJkB2a3simuB1"
3. check your .npmrc content for the above key and verify it's empty:
   //gitlab.vendor.com/api/v4/packages/npm/:_authToken=

[gizero]

Very likely related to what this nopt very old issue is pointing out...

[isaacs]

Use -- to prevent npm from parsing flags and switches on the command line. Not likely to be fixed any time soon, since a lot of code out in the wild depends on npm <some command> --my-custom-thing=whatever

[isaacs]

npm config set -- '//web.archive.org/web/20250502010157/https://gitlab.vendor.com/api/v4/packages/npm/:_authToken' "-iF_9eLYJkB2a3simuB1"