Support URL source / pkg.pr.new

[oliviertassinari]

It would be great to support URL sources, most notably for https://github.com/stackblitz-labs/pkg.pr.new.

For example, in mui/base-ui#4761 we are experimenting with https://x.com/cnakazawa/status/2052640752820424882. We have a new version of the npm package at https://pkg.pr.new/mui/base-ui/@base-ui/react@4761, having this capability supported in packagephobia would make it easier to appreciate the package size increase cost/tradeoff.

[styfle]

Package Phobia requires packages to be published to npm in order to install them.

This provides some safety guarantees because the registry is finite. It also blocks malware and malicious users.

Allowing any git url would likely cost more in compute and storage. Especially if a malicious user decided to enumerate infinite urls.

I don’t really want to add that risk for little gain.

Also pnpm is going to disable installing from URLs in the next version I believe, so it’s not advised to use those as dependencies.