Subpackages, which are defined external to the main package.json can be fetched from the registry. Eventually, the dependencies of all referenced packages will be fulfilled, but this is done by a hack where the metadata of the external package is inferred as having no additional dependencies. When the package is then fetched the state is re-evaluated and possible new dependencies will be resolved.