Adds a warning when using npm through Corepack

README.md

@@ -3,7 +3,7 @@
 Corepack is a zero-runtime-dependency Node.js script that acts as a bridge
 between Node.js projects and the package managers they are intended to be used
 with during development. In practical terms, **Corepack lets you use Yarn, npm,
-and pnpm without having to install them**.
+and other supported package managers without having to install them**.
 
 ## How to Install
 
@@ -50,8 +50,8 @@ See [`CONTRIBUTING.md`](./CONTRIBUTING.md).
 ### When Building Packages
 
 Just use your package managers as you usually would. Run `yarn install` in Yarn
-projects, `pnpm install` in pnpm projects, and `npm` in npm projects. Corepack
-will catch these calls, and depending on the situation:
+projects, `pnpm install` in pnpm projects, etc. Corepack will catch these
+calls, and depending on the situation:
 
 - **If the local project is configured for the package manager you're using**,
   Corepack will silently download and cache the latest compatible version.
@@ -79,7 +79,7 @@ Here, `yarn` is the name of the package manager, specified at version `3.2.3`,
 along with the SHA-224 hash of this version for validation.
 `packageManager@x.y.z` is required. The hash is optional but strongly
 recommended as a security practice. Permitted values for the package manager are
-`yarn`, `npm`, and `pnpm`.
+`yarn` and `pnpm`.
 
 You can also provide a URL to a `.js` file (which will be interpreted as a
 CommonJS module) or a `.tgz` file (which will be interpreted as a package, and
@@ -161,8 +161,6 @@ alias yarn="corepack yarn"
 alias yarnpkg="corepack yarnpkg"
 alias pnpm="corepack pnpm"
 alias pnpx="corepack pnpx"
-alias npm="corepack npm"
-alias npx="corepack npx"
 ```
 
 On Windows PowerShell, you can add functions using the `$PROFILE` automatic
@@ -173,8 +171,6 @@ echo "function yarn { corepack yarn `$args }" >> $PROFILE
 echo "function yarnpkg { corepack yarnpkg `$args }" >> $PROFILE
 echo "function pnpm { corepack pnpm `$args }" >> $PROFILE
 echo "function pnpx { corepack pnpx `$args }" >> $PROFILE
-echo "function npm { corepack npm `$args }" >> $PROFILE
-echo "function npx { corepack npx `$args }" >> $PROFILE
 ```
 
 ### `corepack disable [... name]`
@@ -299,6 +295,12 @@ There are a wide variety of networking issues that can occur while running `core
   `curl [URL]` (ipv4) and `curl -6 [URL]` (ipv6) from your shell.
 - Check your proxy settings (see [Environment Variables](#environment-variables)).
 
+## Non-goals
+
+### Official npm integration
+
+Official npm integration is a non-goal at this time. The npm team made it clear they don't wish npm to be distributed through Corepack (some of their concerns are listed [here](https://github.com/nodejs/node/issues/50963#issuecomment-1862957925)). Corepack focuses on the use case from officially supported package managers.
+
 ## Contributing
 
 See [`CONTRIBUTING.md`](./CONTRIBUTING.md).

sources/corepackUtils.ts

@@ -1,10 +1,12 @@
+import {UsageError}                                            from 'clipanion';
 import {createHash}                                            from 'crypto';
 import {once}                                                  from 'events';
 import {FileHandle}                                            from 'fs/promises';
 import fs                                                      from 'fs';
 import type {Dir}                                              from 'fs';
 import Module                                                  from 'module';
 import path                                                    from 'path';
+import {stderr, stdin}                                         from 'process';
 import semver                                                  from 'semver';
 
 import * as engine                                             from './Engine';
@@ -162,6 +164,27 @@ export async function installVersion(installTarget: string, locator: Locator, {s
     url = decodeURIComponent(version);
   }
 
+  if (process.env.COREPACK_ENABLE_DOWNLOAD_PROMPT === `1`) {
+    console.error(`Corepack is about to download ${url}`);
+
+    if (locator.name === `npm`)
+      console.error(`Corepack support for npm is provided on a best-effort basis and is not officially supported by the npm team`);
+
+    if (stdin.isTTY && !process.env.CI) {
+      stderr.write(`Do you want to continue? [Y/n] `);
+      stdin.resume();
+      const chars = await once(stdin, `data`);
+      stdin.pause();
+
+      // n / N
+      if (chars[0][0] === 0x6e || chars[0][0] === 0x4e)
+        throw new UsageError(`Aborted by the user`);
+
+      // Add a newline to separate Corepack output from the package manager
+      console.error();
+    }
+  }
+
   // Creating a temporary folder inside the install folder means that we
   // are sure it'll be in the same drive as the destination, so we can
   // just move it there atomically once we are done

sources/httpUtils.ts

@@ -1,8 +1,6 @@
-import assert          from 'assert';
-import {UsageError}    from 'clipanion';
-import {once}          from 'events';
-import {stderr, stdin} from 'process';
-import {Readable}      from 'stream';
+import assert       from 'assert';
+import {UsageError} from 'clipanion';
+import {Readable}   from 'stream';
 
 async function fetch(input: string | URL, init?: RequestInit) {
   if (process.env.COREPACK_ENABLE_NETWORK === `0`)
@@ -39,23 +37,6 @@ export async function fetchAsJson(input: string | URL, init?: RequestInit) {
 }
 
 export async function fetchUrlStream(input: string | URL, init?: RequestInit) {
-  if (process.env.COREPACK_ENABLE_DOWNLOAD_PROMPT === `1`) {
-    console.error(`Corepack is about to download ${input}`);
-    if (stdin.isTTY && !process.env.CI) {
-      stderr.write(`Do you want to continue? [Y/n] `);
-      stdin.resume();
-      const chars = await once(stdin, `data`);
-      stdin.pause();
-
-      // n / N
-      if (chars[0][0] === 0x6e || chars[0][0] === 0x4e)
-        throw new UsageError(`Aborted by the user`);
-
-      // Add a newline to separate Corepack output from the package manager
-      console.error();
-    }
-  }
-
   const response = await fetch(input, init);
   const webStream = response.body;
   assert(webStream, `Expected stream to be set`);