diff --git a/node_modules/npm-registry-fetch/CHANGELOG.md b/node_modules/npm-registry-fetch/CHANGELOG.md
index 71232eff75c0e..56d849a773037 100644
--- a/node_modules/npm-registry-fetch/CHANGELOG.md
+++ b/node_modules/npm-registry-fetch/CHANGELOG.md
@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.9.0"></a>
+# [3.9.0](https://github.com/npm/registry-fetch/compare/v3.8.0...v3.9.0) (2019-01-24)
+
+
+### Features
+
+* **auth:** support username:password encoded legacy _auth ([a91f90c](https://github.com/npm/registry-fetch/commit/a91f90c))
+
+
+
 <a name="3.8.0"></a>
 # [3.8.0](https://github.com/npm/registry-fetch/compare/v3.7.0...v3.8.0) (2018-08-23)
 
diff --git a/node_modules/npm-registry-fetch/auth.js b/node_modules/npm-registry-fetch/auth.js
index fa696b97ddee5..d583982d0a8b2 100644
--- a/node_modules/npm-registry-fetch/auth.js
+++ b/node_modules/npm-registry-fetch/auth.js
@@ -25,6 +25,12 @@ function getAuth (registry, opts) {
   if (AUTH.password) {
     AUTH.password = Buffer.from(AUTH.password, 'base64').toString('utf8')
   }
+  if (AUTH._auth && !(AUTH.username && AUTH.password)) {
+    let auth = Buffer.from(AUTH._auth, 'base64').toString()
+    auth = auth.split(':')
+    AUTH.username = auth.shift()
+    AUTH.password = auth.join(':')
+  }
   AUTH.alwaysAuth = AUTH.alwaysAuth === 'false' ? false : !!AUTH.alwaysAuth
   return AUTH
 }
diff --git a/node_modules/npm-registry-fetch/package.json b/node_modules/npm-registry-fetch/package.json
index 81a00978e2e4e..0ffa9a8b9e823 100644
--- a/node_modules/npm-registry-fetch/package.json
+++ b/node_modules/npm-registry-fetch/package.json
@@ -1,8 +1,8 @@
 {
   "_from": "npm-registry-fetch@latest",
-  "_id": "npm-registry-fetch@3.8.0",
+  "_id": "npm-registry-fetch@3.9.0",
   "_inBundle": false,
-  "_integrity": "sha512-hrw8UMD+Nob3Kl3h8Z/YjmKamb1gf7D1ZZch2otrIXM3uFLB5vjEY6DhMlq80z/zZet6eETLbOXcuQudCB3Zpw==",
+  "_integrity": "sha512-srwmt8YhNajAoSAaDWndmZgx89lJwIZ1GWxOuckH4Coek4uHv5S+o/l9FLQe/awA+JwTnj4FJHldxhlXdZEBmw==",
   "_location": "/npm-registry-fetch",
   "_phantomChildren": {},
   "_requested": {
@@ -18,12 +18,18 @@
   "_requiredBy": [
     "#USER",
     "/",
+    "/libnpm",
     "/libnpmaccess",
     "/libnpmhook",
+    "/libnpmorg",
+    "/libnpmpublish",
+    "/libnpmsearch",
+    "/libnpmteam",
+    "/npm-profile",
     "/pacote"
   ],
-  "_resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-3.8.0.tgz",
-  "_shasum": "aa7d9a7c92aff94f48dba0984bdef4bd131c88cc",
+  "_resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-3.9.0.tgz",
+  "_shasum": "44d841780e2833f06accb34488f8c7450d1a6856",
   "_spec": "npm-registry-fetch@latest",
   "_where": "/Users/zkat/Documents/code/work/npm",
   "author": {
@@ -92,5 +98,5 @@
     "update-coc": "weallbehave -o . && git add CODE_OF_CONDUCT.md && git commit -m 'docs(coc): updated CODE_OF_CONDUCT.md'",
     "update-contrib": "weallcontribute -o . && git add CONTRIBUTING.md && git commit -m 'docs(contributing): updated CONTRIBUTING.md'"
   },
-  "version": "3.8.0"
+  "version": "3.9.0"
 }
diff --git a/package-lock.json b/package-lock.json
index a2f2fd4a3c079..f3b0c3b605b71 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3296,9 +3296,9 @@
       }
     },
     "npm-registry-fetch": {
-      "version": "3.8.0",
-      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-3.8.0.tgz",
-      "integrity": "sha512-hrw8UMD+Nob3Kl3h8Z/YjmKamb1gf7D1ZZch2otrIXM3uFLB5vjEY6DhMlq80z/zZet6eETLbOXcuQudCB3Zpw==",
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-3.9.0.tgz",
+      "integrity": "sha512-srwmt8YhNajAoSAaDWndmZgx89lJwIZ1GWxOuckH4Coek4uHv5S+o/l9FLQe/awA+JwTnj4FJHldxhlXdZEBmw==",
       "requires": {
         "JSONStream": "^1.3.4",
         "bluebird": "^3.5.1",
diff --git a/package.json b/package.json
index 0b795b363e15c..31d5ebcbe6b92 100644
--- a/package.json
+++ b/package.json
@@ -98,7 +98,7 @@
     "npm-package-arg": "^6.1.0",
     "npm-packlist": "^1.2.0",
     "npm-pick-manifest": "^2.2.3",
-    "npm-registry-fetch": "^3.8.0",
+    "npm-registry-fetch": "^3.9.0",
     "npm-user-validate": "~1.0.0",
     "npmlog": "~4.1.2",
     "once": "~1.4.0",