Bug: Local npm tarball packages without directory prefix are misclassified as registry packages

[Adityakk9031]

Describe the bug

When a local npm package file (such as a .tgz archive) is located in the current working directory and specified without any path prefix (e.g. npm install package.tgz), the CLI installer precheck fails to recognize it as a local/unverifiable filesystem target. Instead, it attempts to resolve it as a package on the public npm registry.

Where it occurs

In src/precheck/parse.rs within the parse_npm_spec function:

let unverifiable_prefixes = [
    "git+", "git:", "git@", "github:", "gist:", "bitbucket:", "gitlab:", "ssh://", "http://", "https://", "file:",
    "./", "../", "/", "~/", "npm:", "workspace:",
];

A tarball reference like my-package.tgz does not match any of these prefixes, nor does it contain a / (which would trigger the GitHub shorthand/path match). Consequently, it falls through to be parsed as a standard registry package.

Expected Behavior

Local tarballs and directories specified without path prefixes should be recognized as unverifiable filesystem targets (similar to targets starting with ./ or ../), and should not be queried against the public npm registry.

Impact

• Public / Fail-open mode: Prints a loud registry lookup warning and skips tree verification.
• Authenticated / Fail-closed mode: The lookup fails with NOT_FOUND (404) on the registry, which blocks the command execution and halts the package installation entirely.

[Adityakk9031]

@juangaitanv please have look in this issue and commit

[Ibrahimrahhal]

@Adityakk9031 Thanks for opening this issue. @juangaitanv, I think the expected behavior here should be to read the dependencies from the archive. In most cases, the archive should contain a package.json file that we can use to determine the package dependencies.