Wanted to share the output from a client trying to install a package:

25 silly packumentCache corgi:http://localhost/npm/Chainguard/lodash cache-miss
26 http fetch GET 200 http://localhost/npm/Chainguard/lodash 765ms (cache miss)
27 silly packumentCache corgi:http://localhost/npm/Chainguard/lodash set size:6616 disposed:false
28 http fetch GET http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz attempt 1 failed with 500
29 http fetch GET http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz attempt 2 failed with 500
30 http fetch GET http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz attempt 3 failed with 500
31 http fetch GET 500 http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz 73187ms attempt #3 (cache skip)
32 verbose stack HttpErrorGeneral: 500 Internal Server Error - GET http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz - WebException
32 verbose stack     at C:\Program Files\nodejs\node_modules\npm\node_modules\npm-registry-fetch\lib\check-response.js:103:15
32 verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
33 verbose statusCode 500
34 verbose pkgid lodash@http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz
35 error code E500
36 error 500 Internal Server Error - GET http://localhost/npm/Chainguard/lodash/-/lodash-4.17.20.tgz - WebException
37 silly unfinished npm timer reify 1768329298512
38 silly unfinished npm timer reify:unpack 1768329299498
39 silly unfinished npm timer reifyNode:node_modules/lodash 1768329299498

We have this same behavior for both NPM and Python. This presents as a 401 in the WebUI but a 500 from a client.

ProGet Version: 2025.x (latest Docker image as of January 2026)

Feed Types Affected: npm, PyPI

Issue Description:

ProGet connector forwards credentials for package metadata requests but does NOT forward credentials for file download requests, causing downloads to fail with HTTP 500 errors.

Pattern:

• Metadata requests: HTTP 200 (credentials forwarded successfully)
• File downloads: HTTP 500 "WebException" (credentials NOT forwarded, underlying 401 from upstream)

Test Case (npm):

Setup:

• Feed: npm
• Connector URL: https://libraries.cgr.dev/javascript/
• Authentication: Basic Auth

Command:
npm install debug --registry http://localhost/npm/feed-name/

Results:
Metadata: GET /javascript/debug → HTTP 200 (success)
Tarball: GET /javascript/files/.../debug-4.4.3.tgz → HTTP 500 (failure)

npm error: 500 Internal Server Error - WebException

Root Cause:

The upstream registry (Chainguard) uses content-addressable storage where files are at different paths than metadata:

• Metadata: https://libraries.cgr.dev/javascript/debug
• Files: https://libraries.cgr.dev/javascript/files/[hash]/debug-4.4.3.tgz

ProGet forwards credentials to the base URL but not to the /files/ sub-path.

Related Bugs:

This appears similar to Bug PG-1121 (fixed in 4.8.6), but the issue persists in ProGet 2025.x for npm and PyPI feeds.

Questions:

1. Was PG-1121 fix applied to npm/PyPI feeds, or only NuGet?
2. Is there a configuration option to forward credentials to all paths under the connector base URL?
3. Is this a known limitation with content-addressable storage URLs?