It looks like the normalize-package-data dependency calls url.parse(), which throws a runtime deprecation warning in recent versions of node.

Seems to have been fixed as of normalize-package-data v.7.0.1.

Depending on the version of normalized-package-data, this could be either a minor or major bump to read-pkg's node requirements, but technically a breaking change regardless.

LMK if you'd like a PR.

Thanks for your work.