NPM pulls corrupted packages from Verdaccio instance

Chris K. picture Chris K. · Jun 13, 2018 · Viewed 16.4k times · Source

When I perform a basic npm install in an application I am attempting to set up a dev. environment for corrupted packages end up being pulled from my Verdaccio proxy instance.

To Reproduce

Steps to reproduce the behavior:

  1. Set up package.json for my project including adding my dependencies, etc.
  2. Set my local system to use my Verdaccio instance: npm set registry [[Verdaccio Server URL]]:4873.
  3. Perform npm install within the directory I have the package.json in.

Results

I get a ton of output similar to the following:

npm http fetch GET 200 [[Proxy NPM Site]]/@angular%2fplatform-browser-dynamic/-/platform-browser-dynamic-5.2.11.tgz 6430ms
npm WARN tarball tarball data for @angular/[email protected] (sha512-NT8xYl7Vr3qPygisek3PlXqNROEjg48GXOEsDEc7c8lDBo3EB9Tf328fWJD0GbLtXZNhmmNNxwIe+qqPFFhFAA==) seems to be corrupted. Trying one more time.
npm WARN tarball tarball data for [email protected] (sha512-Ubldcmxp5np52/ENotGxlLe6aGMvmF4R8S6tZjsP6Knsaxd/xp3Zrh50cG93lR6nPXyUFwzN3ZSOQI0wRJNdGg==) seems to be corrupted. Trying one more time.
npm WARN tarball tarball data for [email protected] (sha1-1B/UIVTAWTQiy4PEc6OCiqdSW/U=) seems to be corrupted. Trying one more time.

Note the URL encoded name of the package, in this case @angular%2fplatform-browser-dynamic. I do not get this when I set my proxy to be https://registry.npmjs.org/.

Of course, what I would like to do is be able to perform an npm install just as if I were connected to the official registry.

Configuration and Log Files

Additional Information

  • NPM Version: Latest - 6.1.0 but it happens with older versions.
  • Node Version that Verdaccio is running on: 10.4.0
  • Node Version that Client is running on: 10.4.0

Environment: Windows Server 2012 (SP2)

The server that Verdaccio is on is not behind a proxy.

Answer

Chris K. picture Chris K. · Jun 14, 2018

So after performing the following everything worked as intended:

rmdir /S /Q node_modules (or rm -rf node_modules on a *nix derivative OS)
del package-lock.json (or rm package-lock.json on a *nix derivative OS)
npm set registry [[My Verdaccio Instance's IP]]:4873
npm cache clean --force
npm install --force --verbose --no-bin-links