pacote

pacote is the package fetcher that powers the npm CLI. It resolves manifests, downloads tarballs, and extracts packages for any specifier npm understands — registry versions and ranges, git URLs, GitHub shorthands, tarball URLs, and local directories — behind a single consistent API.

Whatever you can pass to npm install, you can pass to pacote. It normalizes each source type, simulates data that isn’t relevant (like a packument for a raw tarball), runs prepare scripts when generating tarballs from git or directory sources, and verifies integrity, giving tooling a uniform way to obtain package contents.

What You Get

• A single API (manifest, packument, tarball, extract) that works across all npm specifier types
• Support for registry, git, GitHub shorthand, remote tarball, file, and directory sources
• Automatic execution of prepare scripts when building tarballs from git or directory sources
• Content-addressable caching and subresource integrity verification via cacache and ssri
• A pacote command-line interface mirroring the programmatic API

Common Use Cases

• Fetching a package manifest without a full install to inspect its metadata
• Extracting any npm-installable package into a target directory programmatically
• Building install tooling that must handle registry, git, and local specifiers uniformly
• Generating publishable tarballs from git or directory sources with prepare scripts run

Under The Hood

Architecture - pacote is organized around a set of Fetcher classes (registry, git, remote, file, directory) that share a common base defining manifest(), packument(), tarball(), and extract(). npm-package-arg parses each specifier into a type, which selects the appropriate fetcher. The base fetcher handles caching through cacache, integrity via ssri, and streaming with minipass/tar; git and directory fetchers additionally clone or copy sources and run prepare scripts via @npmcli/run-script to produce publishable tarballs.

Tech Stack - JavaScript on Node.js. It composes the npm toolchain: npm-registry-fetch for HTTP, @npmcli/git for git operations, npm-package-arg and npm-pick-manifest for specifier and version resolution, cacache and ssri for caching and integrity, tar/minipass/fs-minipass for streaming archives, sigstore for signature verification, and @npmcli/run-script for lifecycle scripts. Tests run under tap.

Code Quality - As a core npm CLI dependency the codebase is heavily maintained (1200+ commits, 70+ releases, active weekly development) with an extensive tap test suite and consistent npm project tooling. Concerns are cleanly separated per fetcher type, and integrity/signature verification is built into the fetch path rather than bolted on.

API Design - The public API is small and orthogonal — manifest, packument, tarball, extract — and its defining ergonomic is that any npm-installable specifier works uniformly across all of them. Options are shared across methods, and irrelevant data is simulated so callers do not special-case source types. Familiarity with npm specifiers makes the library approachable; the main depth is in the many available options for auth, caching, and registries.”