NPM package rejected by corporate firewall

Did you verify this is a real problem by searching the NativeScript Forum and the other open issues in this repo?

Yes. It has been reported in:
https://discourse.nativescript.org/t/installing-nativescript-from-behind-a-corporate-proxy/696

Tell us about the problem

Please, ensure your title is less than 63 characters long and starts with a capital
letter.

The organization I work at requires NPM packages to require dependencies only from NPM. NPM, too, advises against git dependencies. See https://blog.npmjs.org/post/145724408060/dealing-with-problematic-dependencies-in-a: "Generally, we discourage using Git dependencies in package.json, and it’s typically only used temporarily while a maintainer waits for an upstream fix to be applied and published."

When I tried to get NativeScript added to the internal repo for use by developers across the enterprise, my request was rejected because of Github dependencies.

Specifically, the approval team said this module has a dependency on https://github.com/telerik/node-bplist-parser/tarball/master, but the local repo cannot proxy to github.

They advised me to ask you if you could update the above-cited dependency to use a package in the npm registry. They warned that this might be complicated because of the fact that the dependency is a git fork of an npm package. They said you would need to publish your fork on npm and then update this module to use that npm package. This, they argued, would make the module more "corporate firewall friendly", which I assume would promote NativeScript's market share. They said proxying to github in the future is a possibility, but it brings added risk with it. And, per NPM as cited above, github dependencies don't seem to be a best practice anyway.

What I don't understand is why my company's team cited only one github dependency, when package.json seems to show several direct ones. If that needs clarification, I can ask them for it.

Which platform(s) does your issue occur on?

Both

Please provide the following version numbers that your issue occurs with:

• CLI: (run tns --version to fetch it)
  4.2.2

Please tell us how to recreate the issue in as much detail as possible.

That does not seem practical.

首先检查 package.json 以及 github.com/telerik/node-bplist-parser/tarball/master 中引用的依赖项。检查报告中提到的其他直接 GitHub 依赖项，然后确定受影响的 fork 是否可通过 npm 获取；当相关依赖项的安装不再需要访问 GitHub 时，即视为完成。