lpm download

lpm download <package[@version]> [--version <V>] [--output <DIR>]

Fetches a package tarball and extracts it into a directory you choose. No lockfile, no node_modules, no script execution, no package.json mutation. Just the bytes.

Useful for inspecting a package's contents before you trust it, archiving a snapshot for offline reference, generating a fixture, or reading the source of a package you don't want to install.

Routing matches lpm install:

• @lpm.dev/* fetches from LPM.dev Registry.
• @scope/pkg follows the current project's .npmrc @scope:registry=... mapping when one exists.
• Unscoped names (react, zod, lodash.merge) use the current project's default .npmrc registry, or npmjs.org when no override is present.

If you specifically mean an LPM.dev Registry package, prefer the fully scoped @lpm.dev/owner.pkg form.

When npm firewall mode is monitor or enforce, LPM CLI checks routed public npm packages with LPM Firewall at firewall.lpm.dev after selecting the version and before downloading the tarball. LPM Firewall is an LPM.dev Registry Pro/Org feature, so active modes send LPM.dev Registry auth; run lpm login locally, or use LPM_TOKEN / registry-audience OIDC in CI. monitor warns and continues when entitlement is denied, while enforce blocks packages whose effective firewall action is block or denied by entitlement before any package bytes are extracted. In human output, the download line shows 🔥 LPM Firewall active when that check is active. LPM.dev Registry packages and other .npmrc-declared private/custom registry packages are not sent to the npm firewall verdict API. The legacy string report is still accepted as a monitor alias.

Examples

lpm download react                                   # npmjs.org (or project .npmrc default registry)
lpm download react@0.14.3                            # npm-style inline version
lpm download @my-co/internal                         # project .npmrc scoped registry
lpm download @lpm.dev/owner.pkg                      # force LPM.dev Registry
lpm download @lpm.dev/owner.pkg --version 2.1.0      # a specific version
lpm download react --version next                    # dist-tag or semver range
lpm download @lpm.dev/owner.pkg --json               # structured output (URL, integrity, paths)

How it works

1. Fetches the package metadata from the routed registry to find the tarball URL and SRI integrity hash for the requested (or latest) version.
2. Downloads the tarball. Automatically followed redirects are checked before each hop; once the request chain has used HTTPS, a redirect to HTTP fails with refused HTTPS-to-HTTP redirect.
3. Verifies the SRI hash when the registry ships one. If the registry does not ship integrity, lpm download refuses to extract by default; re-run with --allow-unverified only when you intentionally accept an unverified tarball.
4. Extracts into the output directory.

The output directory defaults to the current working directory. The tarball's top-level package/ is unwrapped during extraction (equivalent to tar x --strip-components=1), so you get the package contents directly.

Direct HTTP follows the same rules as lpm install: loopback is available for local development, and a deliberate registry --insecure override can allow a configured non-loopback HTTP endpoint. Neither case allows an HTTPS redirect to downgrade to HTTP. See Redirect transport policy.

What lpm download does NOT do

• Install dependencies — none of the package's dependencies are fetched
• Touch package.json or any lockfile
• Run lifecycle scripts (preinstall, postinstall, etc.)
• Place the result in node_modules/
• Update the global content-addressable store

For a real install, use lpm install. For source delivery into your project, use lpm add.

Flags

Plus the global flags.

--json envelope

{
  "success": true,
  "package": "@lpm.dev/owner.pkg",
  "version": "2.1.0",
  "tarball_url": "https://lpm.dev/api/registry/@lpm.dev/owner.pkg/-/owner.pkg-2.1.0.tgz",
  "integrity": "sha512-...",
  "integrity_verified": true,
  "size_bytes": 87654,
  "output_dir": "/abs/path/to/output",
  "files_extracted": 42,
  "elapsed_secs": 0.412
}

Fields:

See also

• lpm install — full install, with node_modules and lockfile
• lpm add — source delivery into your project
• lpm info — package metadata without downloading
• lpm resolve — print the resolved dep tree without downloading