fix: properly download package tarballs

Refs: nodejs#872

lib/grab-project.js

@@ -1,9 +1,16 @@
+import { createWriteStream } from 'fs';
 import path from 'path';
+import stream from 'stream';
+import { promisify } from 'util';
+
+import undici from 'undici';
 
 import { createOptions } from './create-options.js';
 import { gitClone } from './git-clone.js';
 import { spawn } from './spawn.js';
 
+const pipeline = promisify(stream.pipeline);
+
 export async function grabProject(context) {
   if (context.module.useGitClone) {
     return gitClone(context);
@@ -24,18 +31,23 @@ export async function grabProject(context) {
       `${context.module.name} ${packageManager}:`,
       `Downloading project: ${packageName}`
     );
+
+    // Default timeout to 10 minutes if not provided.
+    const timeout = context.options.timeout || 1000 * 60 * 10;
+
+    if (/^https?:\/\//.test(packageName)) {
+      resolve(downloadPackage(packageName, context, timeout));
+      return;
+    }
+
     let options = createOptions(context.path, context);
     options.stdio = ['ignore', 'pipe', 'pipe'];
     const proc = spawn('npm', ['pack', packageName], options);
 
-    // Default timeout to 10 minutes if not provided
-    const timeout = setTimeout(
-      cleanup,
-      context.options.timeout || 1000 * 60 * 10
-    );
+    const timeoutId = setTimeout(cleanup, timeout);
 
     function cleanup() {
-      clearTimeout(timeout);
+      clearTimeout(timeoutId);
       bailed = true;
       context.emit(
         'data',
@@ -61,13 +73,13 @@ export async function grabProject(context) {
 
     proc.on('error', (err) => {
       bailed = true;
-      clearTimeout(timeout);
+      clearTimeout(timeoutId);
       reject(err);
     });
 
     proc.on('close', (code) => {
       if (bailed) return;
-      clearTimeout(timeout);
+      clearTimeout(timeoutId);
       if (code > 0) {
         return reject(new Error(`Failure getting project from npm\n${stderr}`));
       }
@@ -90,3 +102,24 @@ export async function grabProject(context) {
     });
   });
 }
+
+async function downloadPackage(packageUrl, context, timeout) {
+  const filename = path.basename(packageUrl);
+  const out = path.join(context.path, filename);
+
+  const request = await undici.request(packageUrl, {
+    headersTimeout: timeout,
+    bodyTimeout: timeout,
+    maxRedirections: 5
+  });
+
+  await pipeline(request.body, createWriteStream(out));
+
+  context.emit(
+    'data',
+    'info',
+    `${context.module.name} npm:`,
+    `Project downloaded ${filename}`
+  );
+  context.unpack = out;
+}

package.json

@@ -51,6 +51,7 @@
     "supports-color": "^9.0.2",
     "tar": "^6.1.11",
     "uid-number": "0.0.6",
+    "undici": "^4.9.5",
     "uuid": "^8.3.2",
     "which": "^2.0.2",
     "winston": "^3.3.3",