npm website page returns the wrong content-type response

[maxming2333]

I want to visit the npm homepage of big.js (https://www.npmjs.com/package/big.js) and find that what is displayed on the browser is a string of html text
Then check the request and response the headers, and find that the content-type of the return header is json

Response Headers:

age: 3600
cache-control: public, max-age=14400
cf-cache-status: HIT
cf-ray: 90e26b604c8b7ad9-SJC
content-encoding: br
content-security-policy: connect-src 'self' checkout.stripe.com https://checkout.stripe.com https://billing.stripe.com/session https://api.funcaptcha.com https://api.arkoselabs.com sentry.io api.github.com www.npmjs.com;default-src 'none';img-src * data: https://*.stripe.com;script-src 'self' data: 'unsafe-inline' https://checkout.stripe.com/checkout.js https://checkout.stripe.com https://js.stripe.com/v3 https://platform.twitter.com/widgets.js https://octocaptcha.com https://static-production.npmjs.com/;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://static-production.npmjs.com/;frame-src checkout.stripe.com https://checkout.stripe.com https://js.stripe.com/ https://octocaptcha.com;font-src https://fonts.gstatic.com https://static-production.npmjs.com/ ;media-src https://player.vimeo.com https://fpdl.vimeocdn.com https://gcs-vimeo.akamaized.net https://vod-progressive.akamaized.net
content-type: application/json
date: Fri, 07 Feb 2025 09:40:36 GMT
last-modified: Fri, 07 Feb 2025 08:40:36 GMT
manifest-hash: 74d74467fb70cd5401ce
npm-cost: 1
npm-remaining: 69
renderername: package/package
server: cloudflare
set-cookie: __cf_bm=bWyvIvoNo96BfTQJ1Y9uDvf4Xjr5Za1ZdSK5X9csGig-1738921236-1.0.1.1-epEVHyMdggGgEuj.6QhKuw7QCwRq1j8sLpYet_dcK5Yggda6gAVFs._1OmcTjam0swaESOICAXUpXmDXfoZ8EA; path=/; expires=Fri, 07-Feb-25 10:10:36 GMT; domain=.npmjs.com; HttpOnly; Secure; SameSite=None
set-cookie: __cfruid=41f7a8f6a551dfc8f4897202ecfd5cf06ac09ce0-1738921236; path=/; domain=.npmjs.com; HttpOnly; Secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: x-requested-with, x-spiferack, Accept-Encoding
x-content-security-policy: connect-src 'self' checkout.stripe.com https://checkout.stripe.com https://billing.stripe.com/session https://api.funcaptcha.com https://api.arkoselabs.com sentry.io api.github.com www.npmjs.com;default-src 'none';img-src * data: https://*.stripe.com;script-src 'self' data: 'unsafe-inline' https://checkout.stripe.com/checkout.js https://checkout.stripe.com https://js.stripe.com/v3 https://platform.twitter.com/widgets.js https://octocaptcha.com https://static-production.npmjs.com/;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://static-production.npmjs.com/;frame-src checkout.stripe.com https://checkout.stripe.com https://js.stripe.com/ https://octocaptcha.com;font-src https://fonts.gstatic.com https://static-production.npmjs.com/ ;media-src https://player.vimeo.com https://fpdl.vimeocdn.com https://gcs-vimeo.akamaized.net https://vod-progressive.akamaized.net
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

Screenshot:

---

It seems that the access ending of .js is set by default, and the response header is set to json

But I visit https://www.npmjs.com/package/bignumber.js, it's normal

Screenshot:

[ebndev]

Hi @maxming2333, thanks for being a part of the GitHub Community and for reporting this!

Can you check if big works for you now? I'm able to see it as normal but if not, I can add it to the queue of bugs for the team to track.

[maxming2333]

thanks, Is works for me now