Authentication seems the essential keyword here. Even their npm registry, when configured for a public package, needs an authenticated user before you can pull.

Authentication seems the essential keyword here. Even their npm registry, when configured for a public package, needs an authenticated user before you can pull. This was promised to not be needed over a year ago. We eventually gave up in this as it complicated onboarding new contributors and Ci.