Problem installing version 3.1.1 as a dependency of a package with npm install

[robbiesz]

Hello,

There seems to be a problem with the package manifest in the registry.npmjs.org registry for package vuepress-theme-yuu-3.1.1

The manifest returns these "scripts" for the package:

$ curl https://registry.npmjs.org/vuepress-theme-yuu -s | jq '."versions"."3.1.1"."scripts"'
{
"postinstall": "husky install",
"lint": "eslint . --ext js,vue",
"prepublishOnly": "pinst --disable",
"postpublish": "pinst --enable"
}
However the package itself has a different set of scripts defined in its package.json file:

$ curl "https://registry.npmjs.org/vuepress-theme-yuu/-/vuepress-theme-yuu-3.1.1.tgz" -s | tar xzO package/package.json | jq '."scripts"'
{
"_postinstall": "husky install",
"lint": "eslint . --ext js,vue",
"prepublishOnly": "pinst --disable",
"postpublish": "pinst --enable"
}
The problem is the existence of the 'postinstall' script that prevents npm install to install vuepress-theme-yuu-3.1.1 as a dependency. The reason being is that npm tries to run husky install which expects the vuepress-theme-yuu package to be in development mode.

The package.json in the tgz archive has a deactivated (by pinst) key/script _postinstall which should not interfere with npm install.

I used nodejs-16.19.0 and npm-8.5.5 on Windows and Linux.

Can the manifest somehow be refreshed to reflect the actual package.json contents?

Any help would be appreciated.
Thanks!

[robbiesz]

I opened a problem ticket on github.com/npm but so far noone has responded: npm/feedback#865