fix(publish): handle case where multiple config list is present

When not handled, when there are multiple entries in
this.npm.config.list, it causes crash as described in #2834

The change here merge everything in this.npm.config.list, because as I
observed, the default config is present only at the last entry.

Fix: #2834
Co-authored-by: @wraithgar

PR-URL: #2865
Credit: @kenrick95
Close: #2865
Reviewed-by: @isaacs, @wraithgar

Author: kenrick95

lib/publish.js

@@ -141,7 +141,7 @@ class Publish extends BaseCommand {
   publishConfigToOpts (publishConfig) {
     // create a new object that inherits from the config stack
     // then squash the css-case into camelCase opts, like we do
-    return flatten({...this.npm.config.list[0], ...publishConfig})
+    return flatten({...flatten(this.npm.config.list[0]), ...publishConfig})
   }
 }
 module.exports = Publish

test/lib/publish.js

@@ -473,3 +473,48 @@ t.test('read registry only from publishConfig', t => {
     t.end()
   })
 })
+
+t.test('able to publish after if encountered multiple configs', t => {
+  t.plan(3)
+
+  const registry = 'https://some.registry'
+  const tag = 'better-tag'
+  const publishConfig = { registry }
+  const testDir = t.testdir({
+    'package.json': JSON.stringify({
+      name: 'my-cool-pkg',
+      version: '1.0.0',
+      publishConfig,
+    }, null, 2),
+  })
+
+  const configList = [
+    { ...defaults, tag },
+    { ...defaults, registry: `https://other.registry`, tag: 'some-tag' },
+    defaults,
+  ]
+
+  const Publish = requireInject('../../lib/publish.js', {
+    libnpmpublish: {
+      publish: (manifest, tarData, opts) => {
+        t.same(opts.defaultTag, tag, 'gets option for expected tag')
+      },
+    },
+  })
+  const publish = new Publish({
+    config: {
+      list: configList,
+      getCredentialsByURI: (uri) => {
+        t.same(uri, registry, 'gets credentials for expected registry')
+        return { token: 'some.registry.token' }
+      },
+    },
+  })
+
+  publish.exec([testDir], (er) => {
+    if (er)
+      throw er
+    t.pass('got to callback')
+    t.end()
+  })
+})