If I am a savvy user and am using registry.npmjs.org over HTTPS, and issue a metadata request like this one:
It will tell me to get the tarball over HTTP. What is the point of HTTPS then?
As I checked, both HTTP and HTTPS URLs works for tarball.
NPM registry issue
was told to close it, then we filed
was told to close it, then we filed...
...hopefully to get some traction.