Hi there,
I'm reaching out because bufferutil is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.
The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.
For bufferutil, the script that's affected is:
"install": "node-gyp-build"
That script compiles a native addon, so under the new default it won't run unless the user adds bufferutil to their allowScripts. The change that helps your users most is shipping prebuilt binaries as optionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for bufferutil, a short note in your README showing the allowScripts line people should add will save a lot of confused issues.
I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: npm/rfcs#868. Happy to answer any questions.
Hi there,
I'm reaching out because bufferutil is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.
The RFC blocks dependency install scripts by default during
npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a newallowScriptsfield inpackage.json(or thenpm approve-scriptscommand). The motivation is the run of supply-chain attacks over the last couple of years that usedpostinstallhooks to run code the moment a package landed in the tree.For bufferutil, the script that's affected is:
That script compiles a native addon, so under the new default it won't run unless the user adds
bufferutilto theirallowScripts. The change that helps your users most is shipping prebuilt binaries asoptionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for bufferutil, a short note in your README showing theallowScriptsline people should add will save a lot of confused issues.I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: npm/rfcs#868. Happy to answer any questions.