diff --git a/tools/meteor-npm.js b/tools/meteor-npm.js
index 2eab72a12e..790ddd62a7 100644
--- a/tools/meteor-npm.js
+++ b/tools/meteor-npm.js
@@ -474,8 +474,10 @@ var installNpmModule = function (name, version, dir) {
                             {cwd: dir});
 
   if (! result.success) {
-    var pkgNotFound = "404 '" + name + "' is not in the npm registry";
-    var versionNotFound = "version not found: " + version;
+    var pkgNotFound = "404 '" + utils.quotemeta(name) +
+          "' is not in the npm registry";
+    var versionNotFound = "version not found: " + utils.quotemeta(name) +
+          '@' + utils.quotemeta(version);
     if (result.stderr.match(new RegExp(pkgNotFound))) {
       buildmessage.error("there is no npm package named '" + name + "'");
     } else if (result.stderr.match(new RegExp(versionNotFound))) {
diff --git a/tools/packages.js b/tools/packages.js
index 8118226445..43dac0cacc 100644
--- a/tools/packages.js
+++ b/tools/packages.js
@@ -11,6 +11,7 @@ var meteorNpm = require('./meteor-npm.js');
 var archinfo = require(path.join(__dirname, 'archinfo.js'));
 var linker = require(path.join(__dirname, 'linker.js'));
 var unipackage = require('./unipackage.js');
+var utils = require('./utils.js');
 var fs = require('fs');
 var sourcemap = require('source-map');
 
@@ -28,12 +29,6 @@ var sourcemap = require('source-map');
 // update BUILT_BY, though you will need to quit and rerun "meteor run".)
 exports.BUILT_BY = 'meteor/10';
 
-// Like Perl's quotemeta: quotes all regexp metacharacters. See
-//   https://github.com/substack/quotemeta/blob/master/index.js
-var quotemeta = function (str) {
-    return String(str).replace(/(\W)/g, '\\$1');
-};
-
 var rejectBadPath = function (p) {
   if (p.match(/\.\./))
     throw new Error("bad path: " + p);
@@ -1749,7 +1744,7 @@ _.extend(Package.prototype, {
       // Determine source files
       slice.getSourcesFunc = function () {
         var sourceInclude = _.map(slice.registeredExtensions(), function (ext) {
-          return new RegExp('\\.' + quotemeta(ext) + '$');
+          return new RegExp('\\.' + utils.quotemeta(ext) + '$');
         });
         var sourceExclude = [/^\./].concat(ignoreFiles);
 
diff --git a/tools/utils.js b/tools/utils.js
index 198cdc8897..80ae7ab6e2 100644
--- a/tools/utils.js
+++ b/tools/utils.js
@@ -146,3 +146,8 @@ exports.validEmail = function (address) {
   return /^[^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*@([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}$/.test(address);
 }
 
+// Like Perl's quotemeta: quotes all regexp metacharacters. See
+//   https://github.com/substack/quotemeta/blob/master/index.js
+exports.quotemeta = function (str) {
+    return String(str).replace(/(\W)/g, '\\$1');
+};