npm RFC #868 will block this package's install script by default

Start by reviewing the install script, the package.json dependency setup, and the README alongside npm RFC #868. Determine whether optional prebuilt binaries are practical for bufferutil; otherwise document the required allowScripts entry and verify the resulting installation guidance.

Hi there,

I'm reaching out because bufferutil is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.

The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.

For bufferutil, the script that's affected is:

"install": "node-gyp-build"

That script compiles a native addon, so under the new default it won't run unless the user adds bufferutil to their allowScripts. The change that helps your users most is shipping prebuilt binaries as optionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for bufferutil, a short note in your README showing the allowScripts line people should add will save a lot of confused issues.

I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: https://github.com/npm/rfcs/pull/868. Happy to answer any questions.