Registry website return raw JSON when viewing chart.js package.

[SimonSchick]

When searching for chart.js https://www.npmjs.com/search?q=chart.js I click the first result, rather than opening the package's page it opens the site as json on the page https://www.npmjs.com/package/chart.js

Request headers:

accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
accept-encoding:
gzip, deflate, br, zstd
accept-language:
en-GB,en;q=0.9,de;q=0.8
cache-control:
max-age=0
cookie:
<REMOVED>
if-modified-since:
Sat, 08 Feb 2025 18:17:52 GMT
priority:
u=0, i
referer:
https://www.npmjs.com/search?q=chart.js
sec-ch-ua:
"Not A(Brand";v="8", "Chromium";v="132", "Google Chrome";v="132"
sec-ch-ua-mobile:
?0
sec-ch-ua-platform:
"macOS"
sec-fetch-dest:
document
sec-fetch-mode:
navigate
sec-fetch-site:
same-origin
sec-fetch-user:
?1
upgrade-insecure-requests:
1
user-agent:
<REMOVED>

Response headers:

age:
395
cache-control:
public, max-age=14400
cf-cache-status:
HIT
cf-ray:
<REMOVED>
content-security-policy:
connect-src 'self' checkout.stripe.com https://checkout.stripe.com https://billing.stripe.com/session https://api.funcaptcha.com https://api.arkoselabs.com sentry.io api.github.com www.npmjs.com;default-src 'none';img-src * data: https://*.stripe.com;script-src 'self' data: 'unsafe-inline' https://checkout.stripe.com/checkout.js https://checkout.stripe.com https://js.stripe.com/v3 https://platform.twitter.com/widgets.js https://octocaptcha.com https://static-production.npmjs.com/;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://static-production.npmjs.com/;frame-src checkout.stripe.com https://checkout.stripe.com https://js.stripe.com/ https://octocaptcha.com;font-src https://fonts.gstatic.com https://static-production.npmjs.com/ ;media-src https://player.vimeo.com https://fpdl.vimeocdn.com https://gcs-vimeo.akamaized.net https://vod-progressive.akamaized.net
date:
Sat, 08 Feb 2025 18:24:27 GMT
last-modified:
Sat, 08 Feb 2025 18:17:52 GMT
manifest-hash:
74d74467fb70cd5401ce
npm-cost:
1
npm-remaining:
97
renderername:
package/package
server:
cloudflare
strict-transport-security:
max-age=31536000; includeSubDomains; preload
vary:
x-requested-with, x-spiferack, Accept-Encoding
x-content-security-policy:
connect-src 'self' checkout.stripe.com https://checkout.stripe.com https://billing.stripe.com/session https://api.funcaptcha.com https://api.arkoselabs.com sentry.io api.github.com www.npmjs.com;default-src 'none';img-src * data: https://*.stripe.com;script-src 'self' data: 'unsafe-inline' https://checkout.stripe.com/checkout.js https://checkout.stripe.com https://js.stripe.com/v3 https://platform.twitter.com/widgets.js https://octocaptcha.com https://static-production.npmjs.com/;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://static-production.npmjs.com/;frame-src checkout.stripe.com https://checkout.stripe.com https://js.stripe.com/ https://octocaptcha.com;font-src https://fonts.gstatic.com https://static-production.npmjs.com/ ;media-src https://player.vimeo.com https://fpdl.vimeocdn.com https://gcs-vimeo.akamaized.net https://vod-progressive.akamaized.net
x-content-type-options:
nosniff
x-frame-options:
DENY
x-xss-protection:
1; mode=block

This appears to only happen in chrome.

[stevesinchak]

Its not opening the site as JSON, its giving you the chart.js package metadata in JSON as if you were using a command line tool. What is your User Agent? That could be part of the problem.

This could also be a website problem as it seems related to this issue: https://github.com/orgs/community/discussions/150904