npm install cannot fetch tarballs, not CORS-proxied

[deathcap]

npm.commands.install(['voxel-engine'])
bundle.js:76 npm command require /node_modules/npm/lib/install.js
undefined
bundle.js:39572 OPTIONS http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz 404 (Object Not Found)
localhost/:1 XMLHttpRequest cannot load http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9966' is therefore not allowed access. The response had HTTP status code 404.
bundle.js:96232 Uncaught TypeError: Cannot convert undefined or null to object
bundle.js:39572 OPTIONS http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz 404 (Object Not Found)
localhost/:1 XMLHttpRequest cannot load http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9966' is therefore not allowed access. The response had HTTP status code 404.
bundle.js:96232 Uncaught TypeError: Cannot convert undefined or null to object
Uncaught TypeError: Cannot convert undefined or null to object
bundle.js:39572 OPTIONS http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz 404 (Object Not Found)
localhost/:1 XMLHttpRequest cannot load http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:9966' is therefore not allowed access. The response had HTTP status code 404.
bundle.js:96232 Uncaught TypeError: Cannot convert undefined or null to object
bundle.js:174 npm
bundle.js:174  
bundle.js:174 ERR!
bundle.js:174  
bundle.js:174 fetch failed
bundle.js:174  http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz

bundle.js:174 npm
bundle.js:174  
bundle.js:174 WARN
bundle.js:174  
bundle.js:174 retry
bundle.js:174  will retry, error on last attempt: Error: Network error

The registry (metadata) is accessible as of GH-1, but the technique used was to set the registry URL to http://cors.maxogden.com/http://registry.npmjs.org — but this does not cover tarball download URLs:

npm.commands.view(['voxel-engine'])
     tarball: 'http://registry.npmjs.org/voxel-engine/-/voxel-engine-0.20.1.tgz' },

A more comprehensive means of CORS-ifying network access (browserified request) is needed.