diff --git a/lib/datasource/npm.js b/lib/datasource/npm.js
index 609351de2e9b43c985632f11d3170fd6bf192ca0..b4b31341b9a02921227425acfded956d3c2028c5 100644
--- a/lib/datasource/npm.js
+++ b/lib/datasource/npm.js
@@ -40,9 +40,9 @@ function maskToken(token) {
   if (!token) {
     return token;
   }
-  return `${token.substring(0, 2)}${new Array(token.length - 3).join(
+  return `${token.substring(0, 1)}${new Array(token.length - 1).join(
     '*'
-  )}${token.slice(-2)}`;
+  )}${token.slice(-1)}`;
 }
 
 function setNpmrc(input, exposeEnv = false) {
@@ -130,6 +130,11 @@ async function getDependencyInner(name, retries = 5) {
       authInfo.type = 'Basic';
     }
     headers.authorization = `${authInfo.type} ${authInfo.token}`;
+    logger.debug(
+      `Looking up npm dependency ${name} with token ${maskToken(
+        authInfo.token
+      )}`
+    );
   } else if (process.env.NPM_TOKEN && process.env.NPM_TOKEN !== 'undefined') {
     headers.authorization = `Bearer ${process.env.NPM_TOKEN}`;
   }