[BUG] Packument contains and invokes `"install": "node-gyp rebuild"` when packed package.json does not

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

In fsevents, when npm fetches its packument, its scripts contains "install": "node-gyp rebuild" while if you fetch the tarball, it does not contain that line. As a result, because npm respects the install script from the packument, it will try to call node-gyp rebuild and fail because fsevents does not publish its binding.gyp file. (It comes with a prebuilt .node file)

If a package has an optional dependency on fsevents, it would silently fail on macos when it should be installed instead.

Expected Behavior

npm should not run node-gyp rebuild for fsevents.

Potential solutions

1. When normalizing the manifest for publishing, exclude "gypfile" in its steps option if the package does not publishing binding.gyp (checked from tarball), so that it doesn't handle node-gyp related normalization
2. If the tarball package is not for node-gyp, override and remove the install script if it's the default node-gyp rebuild command.

No1 requires the package to be re-published with the fix to fix the issue. No2 can retroactively fix the issue for other packages.

Current workaround

The package can set "gypfile": false to prevent publish from adding the install script automatically in the manifest.

Steps To Reproduce

1. On MacOS, npm install fsevents
2. npm errors with:

npm error code 1
npm error path /Users/bjorn/Work/repros/test-fsevents/node_modules/fsevents
npm error command failed
npm error command sh -c node-gyp rebuild
npm error gyp info it worked if it ends with ok
npm error gyp info using node-gyp@11.4.2
npm error gyp info using node@24.11.0 | darwin | arm64
npm error gyp info find Python using Python version 3.9.6 found at "/Applications/Xcode.app/Contents/Developer/usr/bin/python3"
npm error gyp info spawn /Applications/Xcode.app/Contents/Developer/usr/bin/python3
npm error gyp info spawn args [
npm error gyp info spawn args '/Users/bjorn/.nvm/versions/node/v24.11.0/lib/node_modules/npm/node_modules/node-gyp/gyp/gyp_main.py',
npm error gyp info spawn args 'binding.gyp',
npm error gyp info spawn args '-f',
npm error gyp info spawn args 'make',
npm error gyp info spawn args '-I',
npm error gyp info spawn args '/Users/bjorn/Work/repros/test-fsevents/node_modules/fsevents/build/config.gypi',
npm error gyp info spawn args '-I',
npm error gyp info spawn args '/Users/bjorn/.nvm/versions/node/v24.11.0/lib/node_modules/npm/node_modules/node-gyp/addon.gypi',
npm error gyp info spawn args '-I',
npm error gyp info spawn args '/Users/bjorn/Library/Caches/node-gyp/24.11.0/include/node/common.gypi',
npm error gyp info spawn args '-Dlibrary=shared_library',
npm error gyp info spawn args '-Dvisibility=default',
npm error gyp info spawn args '-Dnode_root_dir=/Users/bjorn/Library/Caches/node-gyp/24.11.0',
npm error gyp info spawn args '-Dnode_gyp_dir=/Users/bjorn/.nvm/versions/node/v24.11.0/lib/node_modules/npm/node_modules/node-gyp',
npm error gyp info spawn args '-Dnode_lib_file=/Users/bjorn/Library/Caches/node-gyp/24.11.0/<(target_arch)/node.lib',
npm error gyp info spawn args '-Dmodule_root_dir=/Users/bjorn/Work/repros/test-fsevents/node_modules/fsevents',
npm error gyp info spawn args '-Dnode_engine=v8',
npm error gyp info spawn args '--depth=.',
npm error gyp info spawn args '--no-parallel',
npm error gyp info spawn args '--generator-output',
npm error gyp info spawn args 'build',
npm error gyp info spawn args '-Goutput_dir=.'
npm error gyp info spawn args ]
npm error gyp: binding.gyp not found (cwd: /Users/bjorn/Work/repros/test-fsevents/node_modules/fsevents) while trying to load binding.gyp
npm error gyp ERR! configure error 
npm error gyp ERR! stack Error: `gyp` failed with exit code: 1
npm error gyp ERR! stack at ChildProcess.<anonymous> (/Users/bjorn/.nvm/versions/node/v24.11.0/lib/node_modules/npm/node_modules/node-gyp/lib/configure.js:317:18)
npm error gyp ERR! stack at ChildProcess.emit (node:events:508:28)
npm error gyp ERR! stack at ChildProcess._handle.onexit (node:internal/child_process:294:12)
npm error gyp ERR! System Darwin 24.6.0
npm error gyp ERR! command "/Users/bjorn/.nvm/versions/node/v24.11.0/bin/node" "/Users/bjorn/.nvm/versions/node/v24.11.0/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "rebuild"
npm error gyp ERR! cwd /Users/bjorn/Work/repros/test-fsevents/node_modules/fsevents
npm error gyp ERR! node -v v24.11.0
npm error gyp ERR! node-gyp -v v11.4.2
npm error gyp ERR! not ok
npm error A complete log of this run can be found in: /Users/bjorn/.npm/_logs/2025-10-31T03_54_08_061Z-debug-0.log

Environment

• npm: 11.6.1
• Node.js: 24.11.0
• OS Name: macos 15.7.1
• System Model Name: Macbook Pro M1
• npm config:

; "user" config from /Users/bjorn/.npmrc

//registry.npmjs.org/:_authToken = (protected)
ignore-scripts = false

; node bin location = /Users/bjorn/.nvm/versions/node/v24.11.0/bin/node
; node version = v24.11.0
; npm local prefix = /Users/bjorn/Work/repros/test-fsevents
; npm version = 11.6.1
; cwd = /Users/bjorn/Work/repros/test-fsevents
; HOME = /Users/bjorn
; Run `npm config ls -l` to show all defaults.

Start in lib/commands/publish.js and workspaces/arborist/rebuild.js, following the linked package-json normalization logic and the node-gyp-related rebuild handling. Reproduce the fsevents installation failure, then verify that a package whose tarball lacks binding.gyp does not receive or invoke the default node-gyp rebuild script.