[BUG] npm publish with <tarball> parameter recreates tarball

[gstamac]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If I create a tarball with npm pack and then call npm publish my-package.tgz it recreates the tarball and includes my-package.tgz in that tarball. This started happening since v8.5.0 (also tried v8.5.3). Before v8.5.0 npm publish my-package.tgz would simply publish my-package.tgz as is.

Expected Behavior

Publish tarball as is.

Steps To Reproduce

1. Windows and Linux (same behaviour locally, gitlab CI and github CI)
2. Default config
3. Run 'npm pack' and 'npm publish my-package.tgz`
4. See the published package includes my-package.tgz

Environment

• npm: 8.5.3
• Node.js: v16.13.2
• OS Name: Windows 10 and Linux (pipeline)
• System Model Name:
• npm config:

; "user" config from ...

//registry.npmjs.org/:_authToken = (protected)

; node bin location = C:\Program Files\nodejs\node.exe
; cwd = C:\Work\GlobaliD\atlas\packages\atlas-common
; HOME = ...

[wraithgar]

Likely related to the fixes in #4389

[milaninfy]

This appears to be fixed on latest npm@11.2.0. as you can notice from the logs that running npm publish mm-testing-1.0.0.tgz with tarball created with npm pack in earlier step correctly takes two files index.js and package.json

~/workarea/rep/testing $ ls  
index.js		node_modules		package.json
mm-testing-1.0.0.tgz	package-lock.json
~/workarea/rep/testing $ npm publish mm-testing-1.0.0.tgz   
npm notice
npm notice 📦  @mm/testing@1.0.0
npm notice Tarball Contents
npm notice 22B index.js
npm notice 304B package.json
npm notice Tarball Details
npm notice name: @mm/testing
npm notice version: 1.0.0
npm notice filename: mm-testing-1.0.0.tgz
npm notice package size: 332 B
npm notice unpacked size: 326 B
npm notice shasum: f65286b90261ba88de56873bd05086069440fcf0
npm notice integrity: sha512-J0lT7pGMFH2KC[...]xJDa3QnSGB2jg==
npm notice total files: 2
npm notice
npm notice Publishing to http://localhost:4873 with tag latest and default access
+ @mm/testing@1.0.0
~/workarea/rep/testing $ npm view @mm/testing