[BUG]: npmAuthenticate@0 version 0.262.0 inserts invalid VssToken entries and breaks private feed authentication

[bertinnv]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

npmAuthenticate@0

Task version

0.262.0

Issue Description

Summary

The recent versions of the npmAuthenticate@0 task (0.257.x – 0.262.0) are introducing
unexpected and breaking changes in how authentication is injected into .npmrc files.

The task is adding VssToken-based entries inside .npmrc even when:

• No Azure Artifacts feed is selected
• Only external credentials (PAT) are configured
• The .npmrc already contains valid credentials
• The feed is private with known good permissions

This behavior did not happen in previous versions (0.224.x / 0.208.x).

---

Observed Behavior

The task generates additional entries such as:

//pkgs.dev.azure.com/<org>/<project>/_packaging/<feed>/npm/registry/:username=VssToken
//pkgs.dev.azure.com/.../_password=***
//pkgs.dev.azure.com/.../email=VssEmail


### Environment type (Please select at least one enviroment where you face this issue)

- [x] Self-Hosted
- [ ] Microsoft Hosted
- [ ] VMSS Pool
- [ ] Container

### Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

### Azure DevOps Server Version (if applicable)

_No response_

### Operation system

Ubuntu 24.04.3 LTS

### Relevant log output

```shell
2025-11-18T12:25:18.5843870Z [2/4] Fetching packages...
2025-11-18T12:25:18.8945677Z error Error: https://pkgs.dev.azure.com/ORGANIZATION/Support/_packaging/components/npm/registry/styled-components/-/styled-components-4.3.2.tgz: Request failed "401 Unauthorized"
2025-11-18T12:25:18.8946674Z     at ResponseError.ExtendableBuiltin (/usr/local/lib/node_modules/yarn/lib/cli.js:696:66)
2025-11-18T12:25:18.8947620Z     at new ResponseError (/usr/local/lib/node_modules/yarn/lib/cli.js:802:124)
2025-11-18T12:25:18.8949969Z     at Request.<anonymous> (/usr/local/lib/node_modules/yarn/lib/cli.js:66750:16)
2025-11-18T12:25:18.8950236Z     at Request.emit (node:events:517:28)
2025-11-18T12:25:18.8950425Z     at module.exports.Request.onRequestResponse (/usr/local/lib/node_modules/yarn/lib/cli.js:142287:10)
2025-11-18T12:25:18.8950611Z     at ClientRequest.emit (node:events:517:28)
2025-11-18T12:25:18.8950805Z     at HTTPParser.parserOnIncomingClient (node:_http_client:700:27)
2025-11-18T12:25:18.8951008Z     at HTTPParser.parserOnHeadersComplete (node:_http_common:119:17)
2025-11-18T12:25:18.8951191Z     at TLSSocket.socketOnData (node:_http_client:541:22)
2025-11-18T12:25:18.8951357Z     at TLSSocket.emit (node:events:517:28)
2025-11-18T12:25:18.8951528Z info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.

Full task logs with system.debug enabled

 [REPLACE THIS WITH YOUR INFORMATION] 

Repro steps