npm RFC #868 will block this package's install script by default #926

Hi there,

I'm reaching out because node-pty is a package that runs an install script, and an accepted npm RFC is going to change how those scripts behave.

The RFC blocks dependency install scripts by default during npm install. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new allowScripts field in package.json (or the npm approve-scripts command). The motivation is the run of supply-chain attacks over the last couple of years that used postinstall hooks to run code the moment a package landed in the tree.

For node-pty, the script that's affected is:

"install": "node scripts/prebuild.js || node-gyp rebuild"

That script compiles a native addon, so under the new default it won't run unless the user adds node-pty to their allowScripts. The change that helps your users most is shipping prebuilt binaries as optionalDependencies, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for node-pty, a short note in your README showing the allowScripts line people should add will save a lot of confused issues.

I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: npm/rfcs#868. Happy to answer any questions.