diff --git a/lib/manager/npm/post-update/index.ts b/lib/manager/npm/post-update/index.ts
index 632e9dfcbcf5c1b5d428398470ffeb75e1d62b8d..40b373e901136e9ee7d216a8ba56467f47eee848 100644
--- a/lib/manager/npm/post-update/index.ts
+++ b/lib/manager/npm/post-update/index.ts
@@ -467,14 +467,15 @@ export async function getAdditionalFiles(
         );
       }
     } else if (is.string(hostRule.username) && is.string(hostRule.password)) {
+      const password = Buffer.from(hostRule.password).toString('base64');
       if (hostRule.baseUrl) {
         const uri = hostRule.baseUrl.replace(/^https?:/, '');
         additionalNpmrcContent.push(`${uri}:username=${hostRule.username}`);
-        additionalNpmrcContent.push(`${uri}:_password=${hostRule.password}`);
+        additionalNpmrcContent.push(`${uri}:_password=${password}`);
       } else if (hostRule.hostName) {
         const uri = `//${hostRule.hostName}/`;
         additionalNpmrcContent.push(`${uri}:username=${hostRule.username}`);
-        additionalNpmrcContent.push(`${uri}:_password=${hostRule.password}`);
+        additionalNpmrcContent.push(`${uri}:_password=${password}`);
       }
     }
   }