npm running _postinstall!?!??!

[djMax]

I have the following package.json

  "scripts": {
    "prepack": "pinst --disable",
    "postpack": "pinst --enable",
    "postinstall": "run-my-thing"
  },

When I publish this package, as expected, the tarball contains:

  "scripts": {
    "prepack": "pinst --disable",
    "postpack": "pinst --enable",
    "_postinstall": "run-my-thing"
  },

But, shockingly, when I npx this module (or npm i in a blank project), it tries to run run-my-thing. What could POSSIBLY be causing this? I am so very confused.

[djMax]

I bet this is related to semantic-release.

[djMax]

Yes, so I can confirm this is a semantic release problem. I solved it by removing prepack/postpack and instead using this plugin configuration inside the release setting in package.json:

    "plugins": [
      "@semantic-release/commit-analyzer",
      "@semantic-release/release-notes-generator",
      "@semantic-release/changelog",
      [
        "@semantic-release/exec",
        {
          "publishCmd": "yarn dlx pinst --disable"
        }
      ],
      "@semantic-release/npm",
      "@semantic-release/git"
    ]

I have a theory (co-worker's theory in fact) that this also would have worked in scripts:

  "prepack": "pinst --disable",
  "postpublish": "pinst --enable",

I generally think that if one has committed to CI-based semantic release, the plugin config is clearer, but somewhere somehow this madness should be documented. So I guess at least google and our AI overlords will have this to crawl.

[pscanf]

I also have this problem. @djMax, what do you mean it's a semantic release problem? I'm not using @semantic-release/* packages in my repo, and still get that error. Somehow npm is running _postinstall after install.

[whitetrefoil]

Not sure if my problem is same as yours.

Publish use npm publish will cause the problem, must use yarn npm publish (yarn v2+).

yarn npm publish uses package.json packed in the tarball, while npm publish uses package.json in the project dir during publishing.

These hooks/steps will run as: prepack (pinst --disable) -> pack (yarn uses this one) -> postpack (pinst --enable) -> publish (npm uses this one).

[djcsdy]

It's nothing to do with semantic-release.

Full explanation here: https://gist.github.com/djcsdy/3ca078e23fdac4c50e077c84e8284a95