Repository navigation
npm RFC #868 will block this package's install script by default #3061
Description
Hi there,
I'm reaching out because grpc is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.
The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.
For grpc, the script that's affected is:
"install": "node-pre-gyp install --fallback-to-build --library=static_library"
That script compiles a native addon, so under the new default it won't run unless the user adds grpc to their allowScripts. The change that helps your users most is shipping prebuilt binaries as optionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for grpc, a short note in your README showing the allowScripts line people should add will save a lot of confused issues.
I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: npm/rfcs#868. Happy to answer any questions.
Activity
murgatroid99 commentedon Jun 2, 2026
The
grpcpackage has been deprecated for 6 years, and is unsupported.samuelmurray commentedon Jun 26, 2026
I think the same is true for
grpc-tools, which also has ascriptblock withinstallthat runsnode-pre-gyp install.EDIT: see also #2967
aaltat commentedon Jul 13, 2026
The grpc-tools and grpc-tools dependency fsevents suffer from the npm 12.x decision to block install script. With Node: 26.5.0 and npm: 12.0.1, I see the following when installing grpc-tools:
This is caused be change in node and post install script are not anymore allowed by default. There is migration guidance in https://installsafe.dev/ It would be nice if grpc-tools it self would not require post install script. Also it would be nice if fsevents dependency would be updated (in some way) that it would not require post install scripts. Updating protobufjs to the 8.5.x seems to resolve this problem.
murgatroid99 commentedon Jul 17, 2026
Those warnings are coming from more than just
grpc-tools, becausegrpc-toolsdoes not have a transitive dependency on eitherprotobufjsorfsevents.The issue with
grpc-toolsis that currently,node-pre-gypallows us to install only the binary that is appropriate for the current platform and architecture. The only alternative I can think of is to include all of the binaries in the package, and select the appropriate one at runtime. Unfortunately, this will make the install size about 25 MB, which is pretty big. If that's the only reasonable option, I'll do it, but it would be good to know if there are good alternatives that don't use an install script.JamieMagee commentedon Jul 17, 2026
@murgatroid99 you don't need to include all the binaries in the package. The best approach is to publish separate packages for each supported architecture, and include them as
optionalDependenciesin the main package. For examples seeesbuildand@esbuild/linux-arm64,@esbuild/win32-x64,@esbuild/darwin-arm64, etc.