1.2.0 tarballs served from npm unextractable by gnu tar

Hi, not sure how it's happened, but:

$ wget https://registry.npmjs.org/fd-lock/-/fd-lock-1.2.0.tgz
...
$ gunzip fd-lock-1.2.0.tgz
$ tar --version
tar (GNU tar) 1.34
...
$ tar -xvf fd-lock-1.2.0.tar 
package/LICENSE
tar: package/LICENSE: Cannot open: Permission denied
package/binding.cc
tar: package/binding.cc: Cannot open: Permission denied
package/binding.gyp
tar: package/binding.gyp: Cannot open: Permission denied
package/example.js
tar: package/example.js: Cannot open: Permission denied
package/index.js
tar: package/index.js: Cannot open: Permission denied
package/test.js
tar: package/test.js: Cannot open: Permission denied
package/package.json
tar: package/package.json: Cannot open: Permission denied
package/README.md
...
...

Looking at the tar header blocks the only unusual thing I can see is the "owner" fields being null bytes. Would have thought there would be a tar flag that would let this be ignored but can't find one if so.

Just thought you'd like to know..

Reproduce the npm download and GNU tar extraction described in the report, then inspect the published archive entries for package/LICENSE, package/binding.cc, package/binding.gyp, package/index.js, package/test.js, and package/package.json. Compare the archive metadata with a working package and determine what packaging change is needed so GNU tar can extract the files without permission errors.