[BUG] npm config set ignores values starting with "-"

[Ansile]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When npm config set is provided with value that starts with "-", it ignores this value and sets an empty string instead.
This is a serious issue for us, as some tokens can generate starting with "-".

Bug case:

y-golubev:~ y.golubev$ npm -v
8.5.5

y-golubev:~ y.golubev$ npm config set "foo" "-bar"

y-golubev:~ y.golubev$ npm config list
...
foo = ""

Expected Behavior

Instead, it should just set the provided value.

Expected:

y-golubev:~ y.golubev$ npm -v
8.5.5

y-golubev:~ y.golubev$ npm config set "foo" "-bar"

y-golubev:~ y.golubev$ npm config list
...
foo = "-bar" 

That's the way it works with all other values.

Steps To Reproduce

Works the same with basically any npm version.

Run:

npm config set "foo" "-bar"
npm config list | grep foo

Outputs foo = ""

Environment

• npm: 8.5.5
• Node.js: v17.8.0
• OS Name: macOS 10.14.6
• System Model Name: Macbook Pro

[nlf]

this is due to our cli's options parser eating -bar as though it were a flag. to get around this, you can tell the parser you're explicitly done with flags by adding -- to your command. anything that comes after the -- will not be parsed and will correctly show up as a positional argument internally.

> npm config set -- foo -bar
> npm config get foo
-bar

feel free to reopen this issue if that doesn't work for you