According to the docs it's behaviour is equivalent to --strip-components for tar. That argument only strip the first directories until it finds one that has a file or several directories, but download and decompress modules are doing it for all the files, making the decompression wrong. This is particular a problem for Java namespaced classes, where is usual to have several chained namespace folders.

Download waits until the files get completely downloaded before to extract them, making it to consume a lot of memory. Files should be decompress and extracted at the same time they are being downloaded, making it faster and using less memory. This would be fairly easy by using the Streams API on the plugins and the different steps of the decompress pipeline.

Some possible tweaks for your consideration:

1. it gets a header into a variable and then a couple lines down gets it again instead of using the variable. I changed it to reuse the variable.
2. it does return filenameFromPath(res) in two places within a function. I inverted the header existence check to eliminate the first use so it's only at the end.
3. the url package is only used for its parse() functions so I changed it to keep the parse function and use it directly.
4. there are two if statements in a series and both check if there's no output. I changed it to check it once and do the secondary check within that if statement.
5. Travis CI can cache directories which eases up downloads and speeds up the testing. I configured Travis CI to cache node_modules.

buffer.js:203
    buf.copy(buffer, pos);
        ^
TypeError: undefined is not a function
    at Function.Buffer.concat (buffer.js:203:9)
    at DuplexWrapper.<anonymous> (/home/piranna/Proyectos/NodeOS/node_modules/nodeos-barebones/node_modules/nodeos-cross-toolchain/node_modules/download/node_modules/read-all-stream/index.js:35:21)
    at DuplexWrapper.g (events.js:199:16)
    at DuplexWrapper.emit (events.js:129:20)
    at /home/piranna/Proyectos/NodeOS/node_modules/nodeos-barebones/node_modules/nodeos-cross-toolchain/node_modules/download/node_modules/stream-combiner2/node_modules/duplexer2/node_modules/readable-stream/lib/_stream_readable.js:934:16
    at process._tickCallback (node.js:355:11)

I get this each time that I try to use it, seems Buffer object don't have a copy() method. I'm using Node.js 0.12.0, if that matters... The script is the same as yesterday.

When downloading several files at a time, the progress callback (for example when using download-status) should notify the progress globally instead of for each individual download progress.

This tries to download the required files from the server but if you are behind a corporate proxy server it will fail. By using the environment variables to check for a proxy setting this could be avoided. Also this will fix all imagemin modules like imagemin-optipng and imagemin-pngquant that deep down are trying to download the compiled files for windows.

As reported by npm audit:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Arbitrary File Write                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ decompress                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ download                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ download > decompress                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1217                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

https://github.com/kevva/decompress/issues/71

For some reason [email protected] would occasionally give me an empty array instead of the contents of a tgz I had asked download to fetch and extract. Updating resolves this.

See the filename* directive here. This directive is used to encode UTF-8 filenames as HTTP headers must only contain ASCII characters. Examples based on the RFC:

filename*=iso-8859-1'en'%A3%20rates
filename*=UTF-8''%c2%a3%20and%20%e2%82%ac%20rates

I think we can use this module to parse the directive.

environment variables always are strings. The string 'false' means true. process.env.npm_config_strict_ssl !== 'false' is also ok. and , the proxy setting should pass to caw not got

I test it.

var download = new Download()
    .get( "https://s3.amazonaws.com/mozilla-games/emscripten/releases/emsdk-portable.tar.gz", "temp", {extract:true} )
    .use( progress() );

download.run( function(error) {
    if (error) throw error;
});

/project/lib/install.js:6
    if (error) throw error;
                     ^
Error: EISDIR, open 'temp/emsdk_portable/'

In the security vulnerability CVE-2022-33987 - got 8.3.1 used in this library has a problem and should likely be upgraded to a fixed version. I don't know if the GitHub dependabots have triggered this for you, but it's considered a "moderate" issue.

npm audit is failing in packages that use this, reporting:

got <11.8.5 Severity: moderate Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97

The got package is currently specified here at version 8. That would have to be updated to at least 11.8.5 to resolve the audit failure.

It seems that the last letter is removed when downloading a file that has a long and complex filename.

example file: https://images.squarespace-cdn.com/content/v1/6124a4fd689c806393eb581b/81dc0346-e123-4880-89dd-104e34a4f596/Kanalbyen+-+a+new+destination+in+Kristiansand%2C+Norway-high+%281%29+%28brugt+p%C3%A5+forsiden%29.gif

is saved as: Kanalbyen+-+a+new+destination+in+Kristiansand%2C+Norway-high+%281%29+%28brugt+p%C3%A5+forsiden%29.gi

I'm using a mac

As stated from npm audit there's a High vulnerability issue with the package trim-newlines used by download-cli version 1.1.1 which is the latest one.