Part of #9608.
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
Under install-strategy=linked, an optional native binding is installed and symlinked in the store and resolves at runtime, but napi-postinstall run from a consumer package's own store directory reports the binding missing (Failed to find package "@unrs/resolver-binding-darwin-arm64") and tries to re-install it. It is non-fatal only because the public registry serves the binding tarball; on a restricted/proxy registry the re-download fails. The hoisted strategy places the binding at a reachable top-level location and the same check passes silently.
Expected Behavior
A consumer package's installed optional native binding should be resolvable from napi-postinstall's vantage point under the linked strategy, without triggering a redundant re-download, matching the hoisted strategy.
Steps To Reproduce
cd "$(mktemp -d)"
echo 'install-strategy=linked' > .npmrc
cat > package.json <<'EOF'
{ "name": "napi", "version": "1.0.0",
"dependencies": { "unrs-resolver": "1.11.1" },
"allowScripts": { "unrs-resolver": true, "napi-postinstall": true } }
EOF
npm install >/dev/null
cd node_modules/.store/unrs-resolver@*/node_modules/unrs-resolver
node ../.bin/napi-postinstall unrs-resolver 1.11.1 check
# linked: [napi-postinstall] Failed to find package "@unrs/resolver-binding-darwin-arm64" ... Trying to install
# (require.resolve from the same dir finds the binding; hoisted's check passes silently)
Environment
- npm: 12.0.0-pre.1 (
latest)
- Node.js: v24.17.0
- OS Name: macOS (Darwin 25.5.0)
- System Model Name: MacBook (arm64)
- npm config:
Part of #9608.
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
Under
install-strategy=linked, an optional native binding is installed and symlinked in the store and resolves at runtime, butnapi-postinstallrun from a consumer package's own store directory reports the binding missing (Failed to find package "@unrs/resolver-binding-darwin-arm64") and tries to re-install it. It is non-fatal only because the public registry serves the binding tarball; on a restricted/proxy registry the re-download fails. The hoisted strategy places the binding at a reachable top-level location and the same check passes silently.Expected Behavior
A consumer package's installed optional native binding should be resolvable from
napi-postinstall's vantage point under the linked strategy, without triggering a redundant re-download, matching the hoisted strategy.Steps To Reproduce
Environment
latest)install-strategy=linked