NPM dependencies that point to Git / GitHub repos cannot be processed anymore

[ekandler]

The support for npm dependencies that point to repositories, introduced in #4044 , seems to be broken, as calling 'npm view' on a package that is not in the official npm registry triggers an IOException.

Dependency in package.json

"angular-tileview": "github:tinydesk/angular-tileview",

Scanner output

09:20:59.844 [DefaultDispatcher-worker-1] ERROR org.ossreviewtoolkit.analyzer.managers.Npm - Resolving NPM dependencies for path 'package.json' failed with: IOException: Running 'npm view --json angular-tileview@0.6.1' in '[...]' failed with exit code 1:                                                                                                                                   
{                                                                                                                                                                                                                                                                                                                                                                                                                                   
  "error": {                                                                                                                                                                                                                                                                                                                                                                                                                        
    "code": "E404",                                                                                                                                                                                                                                                                                                                                                                                                                 
    "summary": "'angular-tileview' is not in the npm registry.\nYou should bug the author to publish it\n(or use the name yourself!)\n\nNote that you can also install from a\ntarball, folder, http url, or git url.",                                                                                                                                                                                                             
    "detail": "\n 'angular-tileview@0.6.1' is not in the npm registry.\nYou should bug the author to publish it (or use the name yourself!)\n\nNote that you can also install from a\ntarball, folder, http url, or git url."                                                                                                                                                                                                       
  }                                                                                                                                                                                                                                                                                                                                                                                                                                 
} 

Furthermore, if a dependency (that points to a git repository) is also present in the official npm registry, wrong information might be pulled, as it might not be the same package.

[sschuberth]

Some notes to myself, because I wondered about a few things while debugging this:

1. As no version is specified in "github:tinydesk/angular-tileview", NPM will default to master.
2. The version in master is 0.6.1 (which is a whopping 6 years old; no one should be using this anymore, really).
3. There are actually more recent versions tagged, but their code it not in master.
4. No version of angular-tileview is published in the NPM package registry.

All in all, again a "nice" example for weird dependency management in the NPM world...