preinstall script using npx to trigger another package install

[MarcScheib]

Subject of the issue

Installing gridstack via a self-hosted, private registry with authentication causes an issue with the login process when the preinstall script is called using npx.
This was added in 489014c#diff-7ae45ad102eab3b6d7e7896acd08c427a9b25b346470d7bc6507b6481575d519R50

Your environment

Latest version 13.0.0 of gridstack, using a private npm registry with authentication that mirrors to npmjs.com.

Steps to reproduce

Probably not to easy to set up. Here is log output:

npm info run gridstack@13.0.0 preinstall node_modules/gridstack npx only-allow yarn
npm info run gridstack@13.0.0 preinstall { code: 1, signal: null }
npm error command sh -c npx only-allow yarn
npm error npm verbose cli /usr/local/bin/node /usr/local/lib/node_modules/npm/bin/npm-cli.js
npm error npm info using npm@11.11.0
npm error npm info using node@v24.14.1
npm error npm verbose title npm exec only-allow yarn
npm error npm verbose argv "exec" "--" "only-allow" "yarn"
npm error npm verbose logfile logs-max:10 dir:/root/.npm/_logs/2026-07-21T15_03_25_295Z-
npm error npm verbose logfile /root/.npm/_logs/2026-07-21T15_03_25_295Z-debug-0.log
npm error npm warn using --force Recommended protections disabled.
npm error npm warn Unknown env config "email". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm error npm http fetch GET 401 https://nexus.acme.com/repository/acme-npm-registry/only-allow 46ms (cache skip)
npm error npm verbose stack HttpErrorAuthUnknown: Unable to authenticate, need: BASIC realm="Sonatype Nexus Repository Manager"
npm error npm verbose stack     at /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:88:17
npm error npm verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
npm error npm verbose stack     at async RegistryFetcher.packument (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:90:19)
npm error npm verbose stack     at async RegistryFetcher.manifest (/usr/local/lib/node_modules/npm/node_modules/pacote/lib/registry.js:128:23)
npm error npm verbose stack     at async getManifest (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:29:22)
npm error npm verbose stack     at async missingFromTree (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:69:22)
npm error npm verbose stack     at async /usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:191:32
npm error npm verbose stack     at async Promise.all (index 0)
npm error npm verbose stack     at async exec (/usr/local/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:189:3)
npm error npm verbose stack     at async Npm.exec (/usr/local/lib/node_modules/npm/lib/npm.js:209:9)
npm error npm verbose statusCode 401
npm error npm verbose pkgid only-allow@*
npm error npm error code E401

Expected behavior

Ideally, this preinstall is not necessary when installing the lib (see installation guide), or it is added as a dev dependency as well.

As a workaround, I ll try to pass through the auth state to the npx sub-process. Anyways, I want to challenge the usage.