NPM package rejected by corporate firewall

Beginne mit der Prüfung von package.json und der dort angegebenen Abhängigkeit von github.com/telerik/node-bplist-parser/tarball/master. Überprüfe die anderen im Bericht genannten direkten GitHub-Abhängigkeiten und ermittle anschließend, ob der betroffene Fork über npm verfügbar ist; als erledigt gilt dies, wenn die relevanten Abhängigkeiten für die Installation keinen GitHub-Zugriff mehr erfordern.

Did you verify this is a real problem by searching the NativeScript Forum and the other open issues in this repo?

Yes. It has been reported in:
https://discourse.nativescript.org/t/installing-nativescript-from-behind-a-corporate-proxy/696

Tell us about the problem

Please, ensure your title is less than 63 characters long and starts with a capital
letter.

The organization I work at requires NPM packages to require dependencies only from NPM. NPM, too, advises against git dependencies. See https://blog.npmjs.org/post/145724408060/dealing-with-problematic-dependencies-in-a: "Generally, we discourage using Git dependencies in package.json, and it’s typically only used temporarily while a maintainer waits for an upstream fix to be applied and published."

When I tried to get NativeScript added to the internal repo for use by developers across the enterprise, my request was rejected because of Github dependencies.

Specifically, the approval team said this module has a dependency on https://github.com/telerik/node-bplist-parser/tarball/master, but the local repo cannot proxy to github.

They advised me to ask you if you could update the above-cited dependency to use a package in the npm registry. They warned that this might be complicated because of the fact that the dependency is a git fork of an npm package. They said you would need to publish your fork on npm and then update this module to use that npm package. This, they argued, would make the module more "corporate firewall friendly", which I assume would promote NativeScript's market share. They said proxying to github in the future is a possibility, but it brings added risk with it. And, per NPM as cited above, github dependencies don't seem to be a best practice anyway.

What I don't understand is why my company's team cited only one github dependency, when package.json seems to show several direct ones. If that needs clarification, I can ask them for it.

Which platform(s) does your issue occur on?

Both

Please provide the following version numbers that your issue occurs with:

• CLI: (run tns --version to fetch it)
  4.2.2

Please tell us how to recreate the issue in as much detail as possible.

That does not seem practical.