When you run an npm install, the npm client obtains metadata then returns the package:
1. The NPM client requests metadata on the package:
2. The metadata contains the download link for the tar.gz file:
as well as dependency files:
The metadata is pulled from a “package.json” file found in each NPM .tgz file:
npm install foobar
20180523134502|2498|REQUEST|127.0.0.1|admin|GET|/api/npm/npm/foobar|HTTP/1.1|200|0
20180523134503|386|REQUEST|127.0.0.1|admin|GET|/api/npm/npm/foobar/-/foobar-1.1.0.tgz|HTTP/1.1|200|10240
as well as dependency files:
20180523134506|26|REQUEST|127.0.0.1|admin|GET|/api/npm/npm/busybox/-/busybox-2017.3.22.tgz|HTTP/1.1|200|518376
{
"name": "@types/webpack",
"version": "3.8.5",
"description": "TypeScript definitions for webpack",
"license": "MIT",
"contributors": [
[...]
"main": "",
"repository": {
"type": "git",
"url": "https://www.github.com/DefinitelyTyped/DefinitelyTyped.git"
},
"scripts": {},
"dependencies": {
"@types/tapable": "*",
"@types/uglify-js": "*",
"@types/node": "*"
},
"typesPublisherContentHash": "9cb451892d84836f57c4925bdc1308f145e527eed87c3610683ada4330d844ca",
"typeScriptVersion": "2.0"
}