npm RFC #868 will block this package's install script by default
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 38/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- node.js
- Domain
- build-system
Research direction
Start by reviewing package.json's install script, scripts/prebuild.js, and the README, then compare the npm RFC #868 behavior with the current native-addon installation flow. Done means the package has a decided approach for installs with scripts blocked, with either the required packaging changes or clear allowScripts guidance documented for users.
Written by the indexing model from the issue text.
Description
Hi there,
I'm reaching out because node-pty is a package that runs an install script, and an accepted npm RFC is going to change how those scripts behave.
The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.
For node-pty, the script that's affected is:
"install": "node scripts/prebuild.js || node-gyp rebuild"
That script compiles a native addon, so under the new default it won't run unless the user adds node-pty to their allowScripts. The change that helps your users most is shipping prebuilt binaries as optionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for node-pty, a short note in your README showing the allowScripts line people should add will save a lot of confused issues.
I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: https://github.com/npm/rfcs/pull/868. Happy to answer any questions.
- Dominant language
- TypeScript
- Stars
- 2k
- Forks
- 337
- Avg merge
- 13h 17m
- Merged PRs (30d)
- 5
Getting set up
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/node-pty
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
microsoft/node-pty#951 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
All issues in microsoft/node-pty
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Doist/todoist-cli#576 ·
Maintainers usually reply within 1 day
-
🐛 Bug supabase/cli
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
CopilotKit/aimock#491 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
agilepathway/label-checker#710 · 2 comments ·
Maintainers usually reply within 1 day