Track when a package or dependency is private

[pombredanne]

Short Description

Some local packages are "private" and never published in public repositories.
npm has a private flag for instance https://docs.npmjs.com/cli/v6/configuring-npm/package-json#private
We should have a way to track this as these never have a public URL for example.

[aadityasinha-dotcom]

Can I work on this issue?

[pombredanne]

@aadityasinha-dotcom sorry for the late reply! No need to ask... please go for it!

[pombredanne]

Here is an odd npm https://registry.npmjs.org/@restart/ui/-/ui-1.0.1.tgz that contains many private package.json
This was compiled from tsx file ( https://github.com/react-restart/ui/blob/main/src/Anchor.tsx ) which I think are React JSX files but in TypeScript.

[pombredanne]

Carried over from dupe #3524

Handle "multiple personality" packages and private npm correctly

When I scan this: https://files.pythonhosted.org/packages/20/ea/b0969834e5d79365731303be8b82423e6b1c293aa92c28335532ab542f83/Django-4.2.5.tar.gz which is an obvious Pypi package, I can see that Django has a package.json at the root, but this is a "private" package:

{
  "name": "Django",
  "private": true,
  "scripts": {
    "pretest": "eslint .",
    "test": "grunt test --verbose"
  },
  "engines": {
    "npm": ">=1.3.0"
  },
  "devDependencies": {
    "eslint": "^8.36.0",
    "puppeteer": "^19.8.2",
    "grunt": "^1.6.1",
    "grunt-cli": "^1.4.3",
    "grunt-contrib-qunit": "^7.0.0",
    "qunit": "^2.19.4"
  }
}

This ends up being confusing downstream in particular in SCIO.

1. we should find a way to track private packages with a flag. These are common and they also include various lockfile-only unnamed packages foudn when you just build an app and just need dependencies, and are not creating packages. These never have URLs and so on.

2. we need to better handle packages with multiple personalities as there are cases when one personality primes over the other. Secondary package manifest may be there only as a build convenience.

[pombredanne]

Here is some reference info wrt. Pypi

[pombredanne]

Some npm examples:

• https://github.com/freeCodeCamp/freeCodeCamp/blob/fcf577ead157697fadb215409ba05ce1ce211965/web/package.json#L6
• https://github.com/appium/appium/blob/cf3910fdab8e041727c796f5368aeb06a0451c3e/package.json#L4