[BUG] Incorrect detection of install script for `better-sqlite3@13.0.2`?

[achou11]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

I'm seeing an unexpected warning about a better-sqlite@13.0.2 having an install script.

added 2 packages, and audited 3 packages in 342ms

found 0 vulnerabilities
npm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:
npm warn install-scripts   better-sqlite3@13.0.2 (install: node-gyp rebuild)
npm warn install-scripts
npm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.

Expected Behavior

While better-sqlite3 uses node-gyp, the automatic creation of an install script when publishing is disabled by the inclusion of the gypfile: false option in its package.json. See WiseLibs/better-sqlite3#1503 and WiseLibs/better-sqlite3#1505.

I'm not seeing any indication of an install script for this version of better-sqlite3 in the packument API response: https://registry.npmjs.com/better-sqlite3.

The expectation is that there's no warning at all when installing better-sqlite3@13.0.2.

Steps To Reproduce

Create a project with the following package.json:

{
  "type": "module",
  "dependencies": {
    "better-sqlite3": "13.0.2"
  }
}

Run npm install

Environment

• npm: 12.0.2
• Node.js: 24.18.0
• OS Name: macOS 26.5.2 (Tahoe)
• System Model Name: MacBook Air M5
• npm config:

; node bin location = /Users/andrewchou/.local/share/mise/installs/node/24.18.0/bin/node
; node version = v24.18.0
; npm local prefix = /Users/andrewchou/code/github/achou11/npm-allow-scripts-issue-repro
; npm version = 12.0.2
; cwd = /Users/andrewchou/code/github/achou11/npm-allow-scripts-issue-repro
; HOME = /Users/andrewchou
; Run `npm config ls -l` to show all defaults

[edwardjgriggs]

Confirming this, and reporting a more severe form of it: on npm 10 this is not a spurious warning, it is a hard install failure.

npm 11's allowScripts gate happens to save you here — it blocks the implicit script and the bundled prebuild gets used, so you see a warning and a working install. npm 10 has no such gate, so it actually runs node-gyp rebuild, and on any machine without a C++ toolchain the install dies.

This looks like a fresh instance of #3341.

Environment

• Windows 11 26100, node 22.23.1, npm 10.9.8 (npm 10 is what ships with Node 22, the current LTS)
• better-sqlite3@13.0.2, which sets "gypfile": false; the packument entry for it carries no install script and the lockfile entry carries no hasInstallScript

Three cases, same package and lockfile

Command	node-gyp invoked	Result
npm ci from clean	yes	fails
npm install from clean	yes	fails
npm install over an existing node_modules	no	succeeds

That third row is worth attention for triage. The incremental path does not invoke node-gyp, so the package installs cleanly on a machine that already had it. Only a clean install reproduces — which is what CI and new users do, and what a maintainer checking locally often does not.

Failure output

npm error code 1
npm error path <project>\node_modules\better-sqlite3
npm error command failed
npm error command C:\WINDOWS\system32\cmd.exe /d /s /c node-gyp rebuild
npm error gyp info using node-gyp@11.5.0
npm error gyp info using node@22.23.1 | win32 | x64
npm error gyp ERR! find VS msvs_version not set from command line or npm config
npm error gyp ERR! find VS could not find a version of Visual Studio 2017 or newer to use
npm error gyp ERR! not ok

The find VS detail is incidental — a toolchain-less Linux container fails the same way at find Python. The point is that node-gyp runs at all for a package that declared gypfile: false and ships a prebuilt binary for the host.

Why this matters beyond the warning

A CI matrix of {ubuntu, macos, windows} x {node 22, node 24} fails only on windows-latest, node 22 — the one cell combining npm 10 with a platform where a C++ toolchain is not a given. It reads as a Windows problem and is actually an npm-version problem. Anyone on Node 22 LTS installing this package on Windows hits it.

Happy to test a patch or provide more detail.