normalize-package-data is not always run on install

[smikes]

Ref this stack overflow question: https://stackoverflow.com/questions/28173974/node-dependency-package-json-metadata-changing-over-time-for-same-version

It looks like normalize-package-data is not always run on an installed package. The canary here is the absence of a homepage key in package.json, which is added when normalize-package-data is run. Repro set:

$ mkdir test && cd test
$ npm rm is-utf8; npm i is-utf8
unbuild is-utf8@0.2.0
npm WARN package.json @ No description
npm WARN package.json @ No repository field.
npm WARN package.json @ No README data
is-utf8@0.2.0 node_modules/is-utf8
$ grep homepage node_modules/is-utf8/package.json 
  "homepage": "https://github.com/wayfind/is-utf8"
$ npm rm is-utf8 && npm cache clear is-utf8 && npm i is-utf8
unbuild is-utf8@0.2.0
npm WARN package.json @ No description
npm WARN package.json @ No repository field.
npm WARN package.json @ No README data
is-utf8@0.2.0 node_modules/is-utf8
$ grep homepage node_modules/is-utf8/package.json 
$

Thanks to Jen S. for finding this bug.

[iarna]

npm@3 solves this by never running normalize-package-data on what's written to your installed version. It does use normalize-package-data but only internally and never writes that to disk.

Closing this as fixed in npm/npm#multi-stage