Scoped npm packages use %2f encoding for the slash in URLs (e.g. @scope%2fpackage). Previously, the encoded name was used as-is for storage and packument metadata, causing npm install to fail with EINVALIDPACKAGENAME. Now each regex extraction point decodes the package name via decodeURIComponent while keeping the path encoded for correct regex matching.