Problem: npm install slow/timing out in CN — measure before switching mirrors —— Trove problem library

What you will run into

npm install behaves differently across CN networks: ETIMEDOUT / ECONNRESET / fetch failed; or it hangs on a package and even CTRL+C can't kill it; or it's slow while curl to the official registry is fine.

Online tutorials all tell you to switch to the Taobao mirror, but it may be slower for you — a mirror isn't always faster; measure before using it.

Why this happens

Four compounding factors:

1. Official registry network fluctuation: access to registry.npmjs.org from CN is unreliable (CDN node fluctuation);
2. Security audit slows things down: npm by default POSTs to npm/v1/security/advisories/bulk after install for vulnerability checks; on weak networks it can drag installs to tens of seconds;
3. Config leftovers: old registry / proxy settings in ~/.npmrc conflict;
4. Hang: the underlying fetch enters an uninterruptible state under weak network + retry combinations (npm/cli#4028, 226 comments, especially hard to kill on Windows).

Slow/hung npm installs are four independent stages stacked: ① registry resolution (registry.npmjs.org has no stable domestic CDN); ② the security audit request (npm POSTs /npm/v1/security/advisories/bulk after install by default — tens of seconds on weak networks);

③ leftover config (~/.npmrc stale registry/proxy conflicts make requests go the wrong way silently); ④ fetch entering an uninterruptible state under weak network + retries (npm/cli#4028, especially hard to kill on Windows).

All four look like "slow/hung", but each has a different fix.

Deterministic takeaway: layer first — npm config get registry shows the current source, npm ping measures registry latency; switching sources (npmmirror etc.) fixes ①, npm install --no-audit disables the audit and fixes

② (safe to default in CI), cleaning ~/.npmrc fixes ③, and ④ only responds to upgrading npm or killing the process from a fresh terminal;

confirm with npm config list that nothing leftover overrides; fixed diagnostic: stuck at security advisories = ②; stuck at fetch = ①④.

Step by step

1. Measure before switching; don't blindly trust tutorials — Required

time npm ping --registry https://registry.npmjs.org
time npm ping --registry https://registry.npmmirror.com

Measured locally 2026-08-29: ping official 1.7s / mirror 0.8s, but installing typescript took official 8.6s / mirror 13.3s — the mirror isn't always faster; use whichever is faster on your current network.

2. Switch sources — Required

npm install --registry https://registry.npmmirror.com <pkg>   # one-off
npm config set registry https://registry.npmmirror.com        # persistent (writes ~/.npmrc)
npm config set registry https://registry.npmjs.org            # restore

3. Slow → disable audit/fund first — Required

npm install --no-audit --no-fund

Or in ~/.npmrc: audit=false fund=false.

4. Tune timeout/cache — Required

npm config set fetch-timeout 600000
npm config set fetch-retries 5
npm cache verify

Don't jump straight to cache clean --force (full re-download is slower).

5. Hang handling — Required

First confirm it's the network (curl -I https://registry.npmjs.org timed); on Windows taskkill /F /IM node.exe as a last resort; if it hangs often, consider pnpm/yarn (fail fast, different caching strategy).

How to confirm it works

time npm install typescript --no-audit --no-fund

A stable, acceptable-duration install means success. Measured: official 8.6s / npmmirror 13.3s (the mirror was slower that day); npm config get registry confirms the current source.

Other environments

Symptom

npm install behaves in various ways:

npm ERR! code ETIMEDOUT / ECONNRESET / fetch failed   # network-class errors
npm install stuck on some package, CTRL+C does nothing # npm/cli#4028 (226 comments)
npm install very slow while curl to the official registry is fine # slow in resolution/audit

Key traits: the official registry registry.npmjs.org is flaky for Chinese networks (CDN node fluctuation); hangs are especially hard to kill on Windows (#4028 reports unkillable processes); slowness is not always downloads — sometimes it is the audit step.

Same family but different root cause (don't fight the network on this page):

• EACCES / EPERM (global install/cache write permission) -> a permission problem, not network; see the script/file permission family;
• npm ping is fine on both sources but installs are still slow -> the slowness is in audit/resolution; disable audit first (--no-audit --no-fund) instead of switching sources.

Cause

① Official registry network fluctuation: access to registry.npmjs.org from China is unstable; metadata/download requests time out and retry; ② Audit slowdown: npm POSTs to npm/v1/security/advisories/bulk after install by default (npm/cli#7383, 10 comments), which can drag an install to tens of seconds on weak networks; ③ Config residue: stale registry/proxy settings in ~/.npmrc conflict; ④ Hangs: the underlying fetch enters an uninterruptible state under weak-network + retry combinations (#4028).

Solution

1. Measure before switching; do not trust tutorials blindly (networks change daily):

compare time npm ping --registry https://registry.npmjs.org vs time npm ping --registry https://registry.npmmirror.com. Measured here on 2026-08-29: ping official 1.7s / mirror 0.8s, but installing typescript took official 8.6s / mirror 13.3s — the mirror is not always faster; use whichever is faster on your current network.

1. Switch the registry: one-off npm install --registry https://registry.npmmirror.com ...;

persistent npm config set registry https://registry.npmmirror.com (writes ~/.npmrc), restore with npm config set registry https://registry.npmjs.org.

1. Slow? Disable audit/fund first (cheap and effective): npm install --no-audit --no-fund, or add audit=false fund=false to ~/.npmrc.
2. Tune timeouts/retries: npm config set fetch-timeout 600000, fetch-retries 5;

for cache issues run npm cache verify first — avoid cache clean --force unless necessary (full re-download is slower).

1. Handling hangs: first confirm it is the network (curl -I https://registry.npmjs.org timing);

on Windows taskkill /F /IM node.exe as a fallback; if hangs are frequent, consider pnpm/yarn (fail fast, different cache strategy).

1. CI/project level: a project-root .npmrc travels with the repo; in CI, the --registry flag is the most explicit.
2. Security note: ~/.npmrc usually contains a login _authToken — redact before pasting logs/issues. This entry's own evidence log hit exactly that (redacted with sed).

Related canonicals

Read as same root (CN mirror family):

• pip install timeout/slow (same root: mirror family, python side)
• Go module fetch slow/timeout (same root: mirror family, go side)
• docker pull fails / mirror (same root: mirror family, container side)
• GitHub direct connection slow/fails (same network root: ECONNRESET class)