ud.localpath for the npm fetcher is the deps.json file rather than the tarball. When you do bitbake -c cleanall on a recipe fetching from npm://... it will delete the subdirectory containing *all* of the version tarballs for that particular package but not the corresponding deps.json files (only the one for the version the recipe is actually fetching), which means if you try to fetch a different version that was previously fetched, it will think it doesn't need to download the tarball and then fail to unpack when it finds it's not there.

To fix this we could do any one of the following:

1) Stop deleting all of the tarballs, just remove the specific one that matches the version being cleaned

2) Delete all of the deps.json files. Given that npm recipes tend to package the entire dependency tree with the resulting potential overlap in fetched files, I would assume this still runs the risk of stamps for do_fetch tasks for other recipes existing but the tarballs being missing, which wouldn't be right.

3) Don't consider the deps.json file alone when checking if the local file exists, look for the tarball as well. (May still suffer from the issue in #2.)