[BUG] Organization packages installed from the registry are failing to execute the lifecycle scripts

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

Scoped packages (own organization) installed from a registry (GitLab) do not execute the postinstall scripts or any lifecycle scripts. I have tested this behaviour in npm 7 & npm 8 & am aware that npm 8 suppress the output from scripts so I used the following command to test my theory:

npm i --foreground-scripts --loglevel verbose

Other packages execute their postinstall but my package does not run. If I use a local path to the tar file, it does run, but setting the version does not.

If I download the tar manually from the registry & set the path to it, it will run the scripts!

Expected Behavior

Scoped packages installed from a registry exhibit the same behaviour as if I were using a local path to tar file. They should execute the lifecycle scripts.

Steps To Reproduce

None of my scripts are working after publishing an npm package. I will try to give a simple example here to demonstrate the point.

The package.json scripts object (relevant parts) looks like this:

"scripts": {
  "postinstall": "node scripts/postinstall",
}

The scripts/postinstall looks like this:

function main() {
    console.log('hello world')
    process.exit(0);
}

main();

This works when I execute:

$ npm I

inside the package that I am publishing.

When I install it locally it works too:

$ npm i
$ npm run build
$ npm pack --pack-destination

After the pack, in another project, I specify the path to the tar file generated & everything works!

If I run:

$ npm publish

& then install it inside the same project that consumes the node_module, it does not execute the install or postinstall script.

To debug this, I run the command:

npm i --foreground-scripts

and have tried npm i --foreground-scripts --loglevel verbose as well to better understand the problem.

The documentation for the npm lifecycle is lacking & I could not find any information online. Please note that this package is publish in a private gitlab registry and I am able to download & "install" the package as I see it in my node_modules but it does run the lifecycle scripts when installing remotely from npm.

I do have an .npmrc file specified.

Environment

• npm: v8.8.0
• Node.js: v18.1.0
• OS Name: Mac OS Monterey
• System Model Name: Macbook Pro
• npm config:

; "user" config from /Users/unfocused/.npmrc

ignore-script = false 
unsafe-perm = true 

; "project" config from /Users/unfocused/Documents/Git Folders/Projects/example/.npmrc

@org:registry = "https://gitlab.com/api/v4/packages/npm/" 
//gitlab.com/api/v4/packages/npm/:_authToken = (protected) 

; node bin location = /Users/unfocused/.nvm/versions/node/v18.1.0/bin/node
; node version = v18.1.0
; npm local prefix = /Users/unfocused/Documents/Git Folders/Projects/example
; npm version = 8.18.0
; cwd = /Users/unfocused/Documents/Git Folders/Projects/example
; HOME = /Users/unfocused

Start with the package.json scripts object, scripts/postinstall, and the project .npmrc shown in the issue. Reproduce the difference between installing the packed local tarball and installing the published package with npm i --foreground-scripts --loglevel verbose. Done means identifying why the GitLab registry installation skips lifecycle scripts and confirming the expected behavior with a focused reproduction.