[BUG] Failed index access on utils/tar.js while trying to publish a package with node_modules

[NormanPerrin]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm verbose cli /usr/local/bin/node /usr/local/bin/npm
npm info using [email protected]
npm info using [email protected]
npm verbose title npm publish npm-example-v1.tgz
npm verbose argv "publish" "--loglevel" "verbose" "npm-example-v1.tgz"
npm verbose logfile logs-max:10 dir:/Users/normanperrin/.npm/_logs/2024-05-23T06_39_11_271Z-
npm verbose logfile /Users/normanperrin/.npm/_logs/2024-05-23T06_39_11_271Z-debug-0.log
npm verbose publish [ 'npm-example-v1.tgz' ]
npm verbose stack TypeError: Cannot read properties of null (reading '1')
npm verbose stack     at onentry (/usr/local/lib/node_modules/npm/lib/utils/tar.js:63:77)
npm verbose stack     at Parser.<anonymous> (/usr/local/lib/node_modules/npm/node_modules/tar/lib/list.js:57:5)
npm verbose stack     at Parser.emit (node:events:520:28)
npm verbose stack     at [processEntry] (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:248:12)
npm verbose stack     at [nextEntry] (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:259:36)
npm verbose stack     at [consumeHeader] (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:223:32)
npm verbose stack     at [consumeChunkSub] (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:513:30)
npm verbose stack     at [consumeChunk] (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:485:30)
npm verbose stack     at Unzip.<anonymous> (/usr/local/lib/node_modules/npm/node_modules/tar/lib/parse.js:410:59)
npm verbose stack     at Unzip.emit (node:events:520:28)
npm error Cannot read properties of null (reading '1')
npm verbose cwd /Users/normanperrin/.local/work/npm-example
npm verbose os Darwin 23.4.0
npm verbose node v22.2.0
npm verbose npm  v10.8.0
npm verbose exit 1
npm verbose code 1

Expected Behavior

For the package to be published

Steps To Reproduce

1. mkdir package
2. echo '{ "name": "@npm/example", "version": "0.0.1", "engines": { "node": "20.0.0" } }' > package/package.json
3. cp -r node_modules package/node_modules
4. tar -zcvf npm-example-v1.tgz package
5. npm publish --verbose npm-example-v1.tgz

Environment

• npm: 10.8.0
• Node.js: 22.2.0
• OS Name: macOS
• System Model Name: Macbook Pro
• npm config: I have none

[wraithgar]

Can't reproduce with the steps given.

cp -r node_modules package/node_modules

What's in here? Where did it come from?

[NormanPerrin]

Steps to reproduce with the node_modules directory generated:

# 1. Create directory that'll contain the content of the package to publish
mkdir package
# 2. Create any valid package.json
echo '{ "name": "@npm/example", "version": "0.0.1", "engines": { "node": "20.0.0" } }' > package.json
# 3. Can work with any content within the package/node_modules directory
# In example: touch node_modules/file
# but for a more realistic example a dependency can be installed:
npm install emoji-poop
# 4. Copy sufficient files to reproduce the issue to the package directory
cp -r package.json node_modules package
# 5. Compress the package directory
tar -zcvf npm-example-v1.tgz package
# 6. Try to publish, this will fail, showing the bug I tried to explain
npm publish --verbose npm-example-v1.tgz

[wraithgar]

Ah ok I see what's going on here. The manual tarball creation includes the package/node_modules/ entry itself, whereas the tarball that npm normally makes does not.