diff --git a/routers/api/packages/npm/api.go b/routers/api/packages/npm/api.go
index 20da866034a..a2768646cfd 100644
--- a/routers/api/packages/npm/api.go
+++ b/routers/api/packages/npm/api.go
@@ -99,7 +99,7 @@ func createPackageMetadataVersion(registryURL string, pd *packages_model.Package
 		Dist: npm_module.PackageDistribution{
 			Shasum:    pd.Files[0].Blob.HashSHA1,
 			Integrity: "sha512-" + base64.StdEncoding.EncodeToString(hashBytes),
-			Tarball:   fmt.Sprintf("%s/%s/-/%s/%s", registryURL, url.QueryEscape(pd.Package.Name), url.PathEscape(pd.Version.Version), url.PathEscape(pd.Files[0].File.LowerName)),
+			Tarball:   fmt.Sprintf("%s/%s/-/%s/%s", registryURL, url.PathEscape(pd.Package.Name), url.PathEscape(pd.Version.Version), url.PathEscape(pd.Files[0].File.LowerName)),
 		},
 	}
 }
diff --git a/routers/api/packages/npm/api_test.go b/routers/api/packages/npm/api_test.go
index ab3a5821453..09364a2bdda 100644
--- a/routers/api/packages/npm/api_test.go
+++ b/routers/api/packages/npm/api_test.go
@@ -19,12 +19,15 @@ import (
 func TestCreatePackageMetadataResponse(t *testing.T) {
 	descriptor := func(v string, publishedUnix int64) *packages_model.PackageDescriptor {
 		return &packages_model.PackageDescriptor{
-			Package:  &packages_model.Package{Name: "test"},
+			Package:  &packages_model.Package{Name: "@scope/test"},
 			Owner:    &user_model.User{Name: "alice"},
 			Version:  &packages_model.PackageVersion{Version: v, CreatedUnix: timeutil.TimeStamp(publishedUnix)},
 			SemVer:   version.Must(version.NewVersion(v)),
 			Metadata: &npm_module.Metadata{Keywords: []string{"gitea"}},
-			Files:    []*packages_model.PackageFileDescriptor{{File: &packages_model.PackageFile{}, Blob: &packages_model.PackageBlob{}}},
+			Files: []*packages_model.PackageFileDescriptor{{
+				File: &packages_model.PackageFile{LowerName: "test-" + v + ".tgz"},
+				Blob: &packages_model.PackageBlob{},
+			}},
 		}
 	}
 
@@ -43,4 +46,8 @@ func TestCreatePackageMetadataResponse(t *testing.T) {
 	assert.Equal(t, []string{"gitea"}, result.Keywords)
 	assert.Equal(t, []string{"gitea"}, result.Versions["1.0.0"].Keywords)
 	assert.Equal(t, []npm_module.User{{Name: "alice"}}, result.Versions["1.0.0"].Maintainers)
+	assert.Equal(t,
+		"https://gitea.dev/api/packages/alice/npm/@scope%2Ftest/-/1.0.0/test-1.0.0.tgz",
+		result.Versions["1.0.0"].Dist.Tarball,
+	)
 }
diff --git a/tests/integration/api_packages_npm_test.go b/tests/integration/api_packages_npm_test.go
index ab8671a0953..55a3ea70724 100644
--- a/tests/integration/api_packages_npm_test.go
+++ b/tests/integration/api_packages_npm_test.go
@@ -122,8 +122,8 @@ func TestPackageNpm(t *testing.T) {
 		  }`
 	}
 
-	root := fmt.Sprintf("/api/packages/%s/npm/%s", user.Name, url.QueryEscape(packageName))
-	tagsRoot := fmt.Sprintf("/api/packages/%s/npm/-/package/%s/dist-tags", user.Name, url.QueryEscape(packageName))
+	root := fmt.Sprintf("/api/packages/%s/npm/%s", user.Name, url.PathEscape(packageName))
+	tagsRoot := fmt.Sprintf("/api/packages/%s/npm/-/package/%s/dist-tags", user.Name, url.PathEscape(packageName))
 	filename := fmt.Sprintf("%s-%s.tgz", strings.Split(packageName, "/")[1], packageVersion)
 
 	t.Run("Upload", func(t *testing.T) {
@@ -443,7 +443,7 @@ func TestPackageNpm(t *testing.T) {
 		// authoritative tarball scan must overrule the claim.
 		claimPackageName := "@scope/test-shrinkwrap-claim"
 		claimVersion := "1.0.0"
-		claimRoot := fmt.Sprintf("/api/packages/%s/npm/%s", user.Name, url.QueryEscape(claimPackageName))
+		claimRoot := fmt.Sprintf("/api/packages/%s/npm/%s", user.Name, url.PathEscape(claimPackageName))
 		body := `{
 			"_id": "` + claimPackageName + `",
 			"name": "` + claimPackageName + `",