After some further refactoring:

{
  "cpuTime": 0.34559598565101624,
  "envs": {
    "bytes": 6537216,
    "elements": 330112,
    "number": 243520
  },
  "gc": {
    "heapSize": 402915328,
    "totalBytes": 63767152
  },
  "list": {
    "bytes": 985672,
    "concats": 9249,
    "elements": 123209
  },
  "nrAvoided": 358263,
  "nrFunctionCalls": 218872,
  "nrLookups": 82272,
  "nrOpUpdateValuesCopied": 1712032,
  "nrOpUpdates": 18283,
  "nrPrimOpCalls": 171800,
  "nrThunks": 461439,
  "sets": {
    "bytes": 33342256,
    "elements": 2027794,
    "number": 56097
  },
  "sizes": {
    "Attr": 16,
    "Bindings": 16,
    "Env": 16,
    "Value": 24
  },
  "symbols": {
    "bytes": 246484,
    "number": 24916
  },
  "values": {
    "bytes": 13269240,
    "number": 552885
  }
}

In reply to @adis:blad.is
Cool :)

so atm I have 2 questions adisbladis

• if I cleaned up the code to parse .npmrc and pass auth headers based on it into fetchurl, would you be willing to take it?
• is src != packageRoot supposed to work, or is it an unsupported configuration?