Installation fails with npm v7

[andronocean]

For some reason, npm install -g npq fails during the postinstall script when using Node 14.16.0. In my case Node is installed with nvm, however, the npq install works fine on 14.15.4.

Edit (see update below): npm install -g npq fails during the postinstall script when using npm v7.

Expected Behavior

Installation leads to the usual "Thank you for installing npq... do you want to add aliases?" prompt. This works fine with Node 14.16.1 and npm 6.14.12.

Current Behavior

I've tried both a local install (without -g) and the normal global install, with the same result. The prompt text is printed in the middle of the error, before it exits:

npm ERR! path /Users/andron/.nvm/versions/node/v14.16.0/lib/node_modules/npq
npm ERR! command failed
npm ERR! signal SIGINT
npm ERR! command sh -c node scripts/postinstall.js
npm ERR! Thank you for installing npq! We want to help you make conscious decisions before installing potentially dangerous packages.
npm ERR! To do that, we can alias npm and yarn to npq, so that e.g. `npm install <package>` will first use npq to verify the package and prompt you if it finds any issues.
npm ERR! ? Do you want to add zsh aliases for npm and yarn? (Y/n) 

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/andron/.npm/_logs/2021-04-07T14_08_12_889Z-debug.log

Relevant lines from the debug log:

1016 info run npq@2.0.16 postinstall node_modules/npq node scripts/postinstall.js
1017 info run npq@2.0.16 postinstall { code: null, signal: 'SIGINT' }
1018 timing reify:rollback:createSparse Completed in 670ms
1019 timing reify:rollback:retireShallow Completed in 0ms
1020 timing command:install Completed in 5030ms
1021 verbose stack Error: command failed
1021 verbose stack     at ChildProcess.<anonymous> (/Users/andron/.nvm/versions/node/v14.16.0/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/index.js:64:27)
1021 verbose stack     at ChildProcess.emit (events.js:315:20)
1021 verbose stack     at maybeClose (internal/child_process.js:1048:16)
1021 verbose stack     at Socket.<anonymous> (internal/child_process.js:439:11)
1021 verbose stack     at Socket.emit (events.js:315:20)
1021 verbose stack     at Pipe.<anonymous> (net.js:673:12)
1022 verbose pkgid npq@2.0.16
1023 verbose cwd /Users/andron
1024 verbose Darwin 19.6.0
1025 verbose argv "/Users/andron/.nvm/versions/node/v14.16.0/bin/node" "/Users/andron/.nvm/versions/node/v14.16.0/bin/npm" "install" "-g" "npq"
1026 verbose node v14.16.0
1027 verbose npm  v7.8.0
1028 error path /Users/andron/.nvm/versions/node/v14.16.0/lib/node_modules/npq
1029 error command failed
1030 error signal SIGINT
1031 error command sh -c node scripts/postinstall.js
1032 error Thank you for installing npq! We want to help you make conscious decisions before installing potentially dangerous packages.
1032 error To do that, we can alias npm and yarn to npq, so that e.g. `npm install <package>` will first use npq to verify the package and prompt you if it finds any issues.
1032 error ? Do you want to add zsh aliases for npm and yarn? (Y/n)
1033 verbose exit 1

Your Environment (edited per update):

• Version used: 2.0.16
• Environment name and version:
  • Tested with Node.js v14.16.0, 14.16.1, and 15.14.0,
  • Bug occurs with npm 7.7.6 and 7.8.0 (haven't tested further)
  • installed with nvm 0.38.0,
  • zsh shell
• Operating System and version (desktop or mobile): macOS catalina 10.15.7

[andronocean]

Update: seems like the problem is actually with npm v7. On a fresh install of node 14.16.1, which uses npm 6.14.12, npm install -g npq works fine. If I upgrade to npm v7.8, install fails. Similarly, on node 15.14.0 (which comes with npm 7.7.6), install fails identically.

[lirantal]

Oh, that's odd that it would break.
I wonder if it is due to the interactive TTY session that it does or is it something else.

[andronocean]

Any idea for what else I could test to track it down?

[lirantal]

Need to debug first what the issue is there, and I don't have a handy npm7 install to test.
I'll see if I can get around to it to test out.

[lirantal]

@andronocean could you try to update to the latest version of npm7?
looks like this could've been solved already by this: npm/cli#1905

[andronocean]

@lirantal I tried it with npm 7.9.0 on both node 14.16.1 and node 15.14.0, same error unfortunately. I also tried installing in a project instead of globally, no change.

But! I just found a workaround. It's definitely the postinstall script that's causing the failure. I tried npm install -g --ignore-scripts npq, and it completed perfectly and I can run npq. 😄

[lirantal]

Oh nice, thanks for sharing! :-)
I'll try to set some time aside to testing this out for a fix

[lirantal]

Installed with silly log level, getting these:

npm info run npq@2.0.19 postinstall node_modules/npq node scripts/postinstall.js
npm info run npq@2.0.19 postinstall { code: null, signal: 'SIGINT' }
npm timing reify:rollback:createSparse Completed in 611ms
npm timing reify:rollback:retireShallow Completed in 0ms
npm timing command:install Completed in 6032ms
npm verb stack Error: command failed
npm verb stack     at ChildProcess.<anonymous> (/Users/lirantal/.nvm/versions/node/v15.8.0/lib/node_modules/npm/node_modules/@npmcli/promise-spawn/index.js:64:27)
npm verb stack     at ChildProcess.emit (node:events:378:20)
npm verb stack     at maybeClose (node:internal/child_process:1067:16)
npm verb stack     at Socket.<anonymous> (node:internal/child_process:453:11)
npm verb stack     at Socket.emit (node:events:378:20)
npm verb stack     at Pipe.<anonymous> (node:net:665:12)
npm verb pkgid npq@2.0.19
npm verb cwd /private/tmp/a
npm verb Darwin 19.6.0
npm verb argv "/Users/lirantal/.nvm/versions/node/v15.8.0/bin/node" "/Users/lirantal/.nvm/versions/node/v15.8.0/bin/npm" "install" "npq" "--loglevel" "silly"
npm verb node v15.8.0
npm verb npm  v7.5.1
npm ERR! path /private/tmp/a/node_modules/npq
npm ERR! command failed
npm ERR! signal SIGINT
npm ERR! command sh -c node scripts/postinstall.js
npm ERR! Thank you for installing npq! We want to help you make conscious decisions before installing potentially dangerous packages.
npm ERR! To do that, we can alias npm and yarn to npq, so that e.g. `npm install <package>` will first use npq to verify the package and prompt you if it finds any issues.
npm ERR! ? Do you want to add zsh aliases for npm and yarn? (Y/n)
npm verb exit 1
npm timing npm Completed in 6245ms

[lirantal]

I think it is possible that npm7 is now allowing the sort of interactivity that the preinstall script in npq is defined.

I recommend that the fix would be to detect if we're being installed with npm >= 7 and if so to not run that bash script, but instead print to stdout the instructions and recommendation of running that script to get npq added to the shell preferences. We'll likely maybe need to expose another bin that installs that, something like npq-install-shell

[ruyadorno]

@lirantal npm7 will no longer print output for lifecycle scripts of packages being installed by default, thus not allowing for this type of interactive postinstall script to work.

Could I suggest maybe adding instructions to run this script as a manual step after the global install? (maybe provide a top-level command to make it simpler to your users)

[lirantal]

Thanks Ruy, that's a good idea. The npm7 behavior is not to allow interactiveness or not allowing any output printing at all? (or both?). I'm asking, because I'm happy to add another bin entry for a small script that adds the shell config, but I was thinking of prompting the user about this as part of the postinstall process, although if that's not possible then I guess I'll have to revert back to only having these instructions in the project's README.

A side question - is there a reliable way to determine the current version of npm within a postinstall script ?

[OmriBarZik]

You can use the npm_config_user_agent variable. this variable contains some info about the system including the npm version.

[github-actions]

🎉 This issue has been resolved in version 2.0.23 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀