公共 NPM 注册表是否验证上传的 tarball 的校验和？

Question

I recently witnessed an instance of a corrupted package version being published to the npm registry. I've found many questions around what to do in this event (ie republish the package), but few around "What causes it to happen in the first place?"

In my case (which I sadly can't share - private organizational scope, etc etc), pulling the tarball with npm pack reveals that the file is indeed incomplete/corrupt, and does not match the expected checksum.

The npm publish payload includes a dist.Integrity field with a SHA-512 checksum, alongside each package upload. This might be a bit difficult to answer given its closed-source nature - But does the NPM registry do any validation on its side, to check that the uploaded contents actually match the checksum, before making the package version available for consumption?

Thanks in advance!

Answer 1

Follow-up: Yes, it does. I verified this by capturing an npm upload payload and changing the dist.integrity checksum. NPM correctly diagnosed the checksum mismatch, and refused the package.