[BUG] `npm pack` incorrect filename for scoped package

[breavyn]

Is there an existing issue for this?

• [X] I have searched the existing issues

Current Behavior

npm pack and npm pack --json show the incorrect filename when packing a package with a scoped name.

% npm pack
npm notice
npm notice 📦  @my-scope/[email protected]
npm notice === Tarball Contents ===
npm notice 0B   index.js
npm notice 276B my-scope-my-package-1.0.0.tgz
npm notice 234B package.json
npm notice === Tarball Details ===
npm notice name:          @my-scope/my-package
npm notice version:       1.0.0
npm notice filename:      @my-scope/my-package-1.0.0.tgz
npm notice package size:  611 B
npm notice unpacked size: 510 B
npm notice shasum:        ab0b16e335388b69eec923e62d66d7f1eaf33cb7
npm notice integrity:     sha512-/PBmytzQRHwxf[...]FpBf4pRsXjy4w==
npm notice total files:   3
npm notice
my-scope-my-package-1.0.0.tgz

Notice npm notice filename: @my-scope/my-package-1.0.0.tgz is not the correct filename.

% npm pack --json
[
  {
    "id": "@my-scope/[email protected]",
    "name": "@my-scope/my-package",
    "version": "1.0.0",
    "size": 276,
    "unpackedSize": 234,
    "shasum": "2ce6365bb4ea5e1fc04b9bc24815b479024f392d",
    "integrity": "sha512-ZzUDBQ6QDe1X/+7hXofN3BLvbzFD7EPiuxzwAU7MsJiHQRpk3nod8ezGCo4CCNekQvGXF7wQwQnPkCddCUyimQ==",
    "filename": "@my-scope/my-package-1.0.0.tgz",
    "files": [
      {
        "path": "index.js",
        "size": 0,
        "mode": 420
      },
      {
        "path": "package.json",
        "size": 234,
        "mode": 420
      }
    ],
    "entryCount": 2,
    "bundled": []
  }
]

Expected Behavior

The correct filename to be displayed, in the above example my-scope-my-package-1.0.0.tgz.

Steps To Reproduce

1. In a project with a scoped package e.g @my-scope/my-package
2. Run npm pack or npm pack --json

Environment

• OS: Gentoo Linux
• Node: 16.3.0
• npm: 7.15.1 (also tested on latest HEAD)

[breavyn]

Perhaps it is just a matter of adding the string replacement, .replace(/^@/, '').replace(/\//, '-'), here. https://github.com/npm/cli/blob/3f202cd777897d2213820fb00a4e85f440f69701/lib/utils/tar.js#L105

Instead of at individual sites like here. https://github.com/npm/cli/blob/3f202cd777897d2213820fb00a4e85f440f69701/lib/pack.js#L83-L86

[noahtallen]

Verifying this is still an issue on npm v8.1.3:

$ ls

$ npm pack "@wordpress/data-controls"
npm notice
npm notice 📦  @wordpress/[email protected]
...
npm notice filename:      @wordpress/data-controls-2.2.6.tgz
...
wordpress-data-controls-2.2.6.tgz

$ ls
wordpress-data-controls-2.2.6.tgz

[noahtallen]

A workaround is to use an older npm version, such as v6.14.15.

[phated]

Just encountered this same issue in some workflows.

[fredxie]

Is there any update on this? Experiencing the same issue here. scoped prefix (@xxx) transformed to incorrect tarball name.