This is basically a copy-paste from the old way npm would set permissions on extract, and should now be fully compatible again. I hope. Sigh.
