npm RFC #868 will block this package's install script by default

Hi there,

I'm reaching out because grpc is one of the most depended-on npm packages that runs an install script, and an accepted npm RFC is going to change how those scripts behave.

The RFC blocks dependency install scripts by default during `npm install`. That's the same thing pnpm, Yarn Berry, Bun, and Deno already do. Users opt back in per package through a new `allowScripts` field in `package.json` (or the `npm approve-scripts` command). The motivation is the run of supply-chain attacks over the last couple of years that used `postinstall` hooks to run code the moment a package landed in the tree.

For grpc, the script that's affected is:

"install": "node-pre-gyp install --fallback-to-build --library=static_library"

That script compiles a native addon, so under the new default it won't run unless the user adds `grpc` to their `allowScripts`. The change that helps your users most is shipping prebuilt binaries as `optionalDependencies`, the pattern esbuild, sharp, and @swc/core moved to. Most installs then need no compile step and no allowlist entry. If prebuilds aren't practical for grpc, a short note in your README showing the `allowScripts` line people should add will save a lot of confused issues.

I wanted to flag this early so you've got time to plan rather than find out when the install warnings start showing up. The full RFC is here: https://github.com/npm/rfcs/pull/868. Happy to answer any questions.