function add (args, where, cb) {
  // this is hot code.  almost everything passes through here.
  // the args can be any of:
  // ['url']
  // ['pkg', 'version']
  // ['pkg@version']
  // ['pkg', 'url']
  // This is tricky, because urls can contain @
  // Also, in some cases we get [name, null] rather
  // that just a single argument.

  var usage = 'Usage:\n' +
              '    npm cache add <tarball-url>\n' +
              '    npm cache add <pkg>@<ver>\n' +
              '    npm cache add <tarball>\n' +
              '    npm cache add <folder>\n'
  var spec

  log.silly('cache add', 'args', args)

  if (args[1] === undefined) args[1] = null

  // at this point the args length must ==2
  if (args[1] !== null) {
    spec = args[0] + '@' + args[1]
  } else if (args.length === 2) {
    spec = args[0]
  }

  log.verbose('cache add', 'spec', spec)

  if (!spec) return cb(usage)

  adding++
  cb = afterAdd(cb)

  realizePackageSpecifier(spec, where, function (err, p) {
    if (err) return cb(err)

    log.silly('cache add', 'parsed spec', p)

    switch (p.type) {
      case 'local':
      case 'directory':
        addLocal(p, null, cb)
        break
      case 'remote':
        // get auth, if possible
        mapToRegistry(p.raw, npm.config, function (err, uri, auth) {
          if (err) return cb(err)

          addRemoteTarball(p.spec, { name: p.name }, null, auth, cb)
        })
        break
      case 'git':
      case 'hosted':
        addRemoteGit(p.rawSpec, cb)
        break
      default:
        if (p.name) return addNamed(p.name, p.spec, null, cb)

        cb(new Error("couldn't figure out how to install " + spec))
    }
  })
}
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.