We are running into this same problem, and have the same npm setup:
npm group repo
→ npm hosted repo
→ npm proxy which points to npmjs.org
A new version of a one of our in-house packages was published to the hosted repo over 24 hours ago. If I browse the package root metadata of the private repo, I get the correct latest version back, but when I do the same on the group repo, it reports the old version as latest.
It seems like there must be additional caching at the group-level repo, and if so we aren’t able to configure any timeout on caching at that level, as we would be for a proxy repo.