执行npm i时触发dependencies脚本是否为Node.js v19.8.1的Bug？

在Node.js v19.8.1版本中，执行npm i时触发了dependencies脚本，想确认这是否是Bug。

复现步骤 #

• 执行以下命令创建测试项目：

mkdir test
cd test
npm init -y

• 将package.json修改为如下内容：

{
  "name": "temp",
  "version": "1.0.0",
  "description": "",
  "scripts": {
    "dependencies": "cd app",
    "echo": "echo \"$PWD\""
  },  
  "main": "index.js",
  "keywords": [],
  "author": "",
  "license": "ISC",
  "dependencies": {
    "cpx": "^1.5.0",
    "node-pretty-log": "*"
  }
}

• 运行npm i，出现报错：

npm i
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated chokidar@1.7.0: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated core-js@2.6.12: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm ERR! code 1
npm ERR! path /Users/oleersoy/Temp/temp
npm ERR! command failed
npm ERR! command sh -c cd app
npm ERR! sh: line 0: cd: app: No such file or directory

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/oleersoy/.npm/_logs/2023-04-17T18_50_22_257Z-debug-0.log
oleersoy@Oles-MacBook-Pro temp % npm i
npm ERR! code 1
npm ERR! path /Users/oleersoy/Temp/temp
npm ERR! command failed
npm ERR! command sh -c cd app
npm ERR! sh: line 0: cd: app: No such file or directory

从报错信息可见，npm i尝试执行了dependencies脚本中的cd app命令，因app目录不存在而报错。

回答 #

这不是Bug，是npm的设计行为。

npm的脚本系统中，核心命令install（即npm i）会自动关联触发名为dependencies的脚本。当你在package.json的scripts字段中定义了这个名称的脚本，执行npm i时就会自动运行它。

解决方式

• 重命名脚本：将dependencies脚本改为其他非关联名称，比如setup:dependencies，避免被npm i自动触发。
• 跳过脚本执行：如果需要保留脚本名称但不想在安装时触发，可以执行npm install --ignore-scripts，该命令会跳过所有npm钩子脚本的执行。

内容的提问来源于stack exchange，提问作者Ole