NPM package rejected by corporate firewall

Bắt đầu bằng cách kiểm tra package.json và dependency được trích dẫn tại github.com/telerik/node-bplist-parser/tarball/master. Kiểm tra các dependency GitHub trực tiếp khác được đề cập trong báo cáo, sau đó xác định xem fork bị ảnh hưởng có sẵn trên npm hay không; công việc được xem là hoàn tất khi các dependency liên quan không còn yêu cầu truy cập GitHub để cài đặt.

Did you verify this is a real problem by searching the NativeScript Forum and the other open issues in this repo?

Yes. It has been reported in:
https://discourse.nativescript.org/t/installing-nativescript-from-behind-a-corporate-proxy/696

Tell us about the problem

Please, ensure your title is less than 63 characters long and starts with a capital
letter.

The organization I work at requires NPM packages to require dependencies only from NPM. NPM, too, advises against git dependencies. See https://blog.npmjs.org/post/145724408060/dealing-with-problematic-dependencies-in-a: "Generally, we discourage using Git dependencies in package.json, and it’s typically only used temporarily while a maintainer waits for an upstream fix to be applied and published."

When I tried to get NativeScript added to the internal repo for use by developers across the enterprise, my request was rejected because of Github dependencies.

Specifically, the approval team said this module has a dependency on https://github.com/telerik/node-bplist-parser/tarball/master, but the local repo cannot proxy to github.

They advised me to ask you if you could update the above-cited dependency to use a package in the npm registry. They warned that this might be complicated because of the fact that the dependency is a git fork of an npm package. They said you would need to publish your fork on npm and then update this module to use that npm package. This, they argued, would make the module more "corporate firewall friendly", which I assume would promote NativeScript's market share. They said proxying to github in the future is a possibility, but it brings added risk with it. And, per NPM as cited above, github dependencies don't seem to be a best practice anyway.

What I don't understand is why my company's team cited only one github dependency, when package.json seems to show several direct ones. If that needs clarification, I can ask them for it.

Which platform(s) does your issue occur on?

Both

Please provide the following version numbers that your issue occurs with:

• CLI: (run tns --version to fetch it)
  4.2.2

Please tell us how to recreate the issue in as much detail as possible.

That does not seem practical.