[BUG] Npm mirrored the complete git repo when the version is a commit hash

[mmis1000]

Current Behavior:

When there is a git dependency in the "dependencies" that point to specific hash.
NPM mirrored the complete repo.

"dependencies": {
    "xterm": "git+https://github.com/xtermjs/xterm.js.git#0320e6e22a67fe5d50b07df1d9f310684df2e561"
  }

Expected Behavior:

NPM only pull specific commit unless there is no server support of fetch by commit.

Since 2015,
It is possible to fetch a commit directly with sha1 hash with following sequence. (if the server enabled that function)

https://stackoverflow.com/questions/14872486/retrieve-specific-commit-from-a-remote-git-repository/30701724#30701724

git init
git remote add origin $REPO_URL
git fetch --depth=1 origin $COMMIT_HASH
git checkout $COMMIT_HASH

Steps To Reproduce:

1. add git+https://github.com/xtermjs/xterm.js.git#0320e6e22a67fe5d50b07df1d9f310684df2e561 to package.json
2. run npm i
3. view git process spawned by npm with ps/top/htop

Environment:

• OS: Mac
• Node: v10.21.0
• npm: 6.14.8

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.