Repository: deno
Issue: NPM_CONFIG_REGISTRY seemingly ignored on subsequent runs of `deno cache`
Labels: bug,node compat

Deno 1.29.1
macOS 11.6.4

I added my first `import` for an `npm:` specifier and ran `NPM_CONFIG_REGISTRY=https://registry.mycompany.com/path/to/destination/ deno cache --node-modules-dir` to download a local copy through my company's Artficatory (public NPM is blocked) and it worked fine. However, when I run `NPM_CONFIG_REGISTRY=https://registry.mycompany.com/path/to/destination/ deno cache ...` again, I get `BadCertificate` errors with additional output showing that it seems to be trying to use the default NPM registry again.

```
Sending fatal alert BadCertificateg/<npm-package> (0/#)
Sending fatal alert BadCertificate
Sending fatal alert BadCertificate
Sending fatal alert BadCertificate
Sending fatal alert BadCertificate
Sending fatal alert BadCertificate
error: failed reading lockfile '/path/to/project/deno.lock'

Caused by:
    0: Error getting response at https://registry.npmjs.org/<dependency-package>
    1: error sending request for url (https://registry.npmjs.org/<dependency-package>): error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
    2: error trying to connect: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
    3: invalid peer certificate contents: invalid peer certificate: UnknownIssuer
```

After some trial and error, I found that I could run the `deno cache` command again if I deleted the lock file (which oddly doesn't capture the registry URLs of the NPM packages).

Not captured in the above output as the first line because it gets overwritten by the error output is:

```
Download https://registry.npmjs.org/<dependency-package>
```

Which seems to confirm that it is falling back to the default registry. When I run the command after deleting the lock file, that first line of output shows the correctly overridden registry URL.

I did some digging into the Deno codebase to find how the NPM registry is set and why it would fail on subsequent runs of `deno cache` with `NPM_CONFIG_REGISTRY` set and I found [this](https://github.com/denoland/deno/blob/10e4b2e14046b74469f7310c599579a6611513fe/cli/npm/registry.rs#L230-L262) where the Registry URL is produced. I don't know Rust at all so figuring out where this is called in relation to the `deno cache` command proved to be challenging, but I noticed the warning when using the old private ENV var `DENO_NPM_REGISTRY`. I deleted the lock file, switched the `deno cache` command to use the private one, and saw the warning defined in `RealNpmRegistryApi::default_url()` in the output. Then when I ran it a second time, I got the above error output with no sign of the ENV var warning, which seems to indicate that the registry override is not being retrieved the same way on subsequent runs of `deno cache` when a lock file is present.

My full `deno cache` command (with a dummy Registry URL) that I committed to a Task command is:

```
$ NPM_CONFIG_REGISTRY=https://registry.mycompany.com/path/to/destination/ deno cache --reload --lock-write --node-modules-dir app.ts
```