npm install hangs when installing Request Network SDK packages

[MantisClone]

Problem

npm install hangs indefinitely when installing Request Network SDK packages (e.g., @requestnetwork/request-client.js). This prevents users from installing our SDK with npm, forcing them to use pnpm as a workaround.

Proposed Solution

Investigate the root cause and ensure our published packages are installable with npm, yarn, and pnpm.

Considerations

• The monorepo uses Yarn 1.22.22 for development, but published packages should work with any package manager
• Our packages require Node.js >= 22.0.0
• pnpm works fine, so the issue may be npm-specific behavior with our dependency tree or package metadata
• May be related to recent npm policy changes

---

Reports

• Rodrigo Pavezi (Dec 15, 2024) - had to switch to pnpm to continue work on payments-subgraph
• Aimen Sahnoun (Dec 19, 2024) - same issue when installing newly released packages into the API

Steps to Reproduce

1. Create a new project
2. Run npm install @requestnetwork/request-client.js
3. Observe that npm hangs and does not complete

Workaround

Use pnpm instead:

pnpm add @requestnetwork/request-client.js

Investigation Tasks

• Reproduce the issue locally with different npm versions
• Run npm install --verbose to identify where the hang occurs
• Check if specific packages or dependency combinations trigger the hang
• Investigate npm registry logs for any errors
• Check package metadata and tarball downloads
• Review recent package releases for any changes that might cause this

[coderabbitai]

🔗 Similar Issues

Related Issues

• Fix linking local RN SDK packages into the web-components repo public-issues#51
• SDK - Migrate to OIDC Trusted Publisher for NPM publishing #1648

🔗 Related PRs

RequestNetwork/request-api#375 - chore: remove package-lock.json and update package.json dependencies for requestnetwork packages [closed]
RequestNetwork/request-api#376 - chore: update .npmrc to set minimum release age for packages [closed]

👤 Suggested Assignees

• MantisClone
• aimensahnoun

---

Enable issue planning

_{To enable issue planning, add the following to your .coderabbit.yaml:}

issue_enrichment:
  planning:
    enabled: true

_{You can then request a plan by commenting @coderabbitai plan on any issue.}

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord or schedule a call!

[envoy1084]

I was able to reproduce the npm install @requestnetwork/request-client.js hang locally.

This is not a registry or metadata issue and not npm-specific behavior.

The install hangs during native dependency compilation.

On Node v23.x, npm install silently stalls while running node-gyp.
You can confirm this by running ps aux | grep node-gyp in another terminal while npm appears stuck.

---

Where it comes from

@requestnetwork/request-client.js → @requestnetwork/utils depends on:

"@toruslabs/eccrypto": "4.0.0",
"secp256k1": "4.0.4"

secp256k1@4.0.4 is a native C++ addon and does not support Node 23 ABI.
On macOS, this causes node-gyp to hang without emitting an error.

npm is the only package manager that consistently attempts a clean native rebuild, which is why:

• npm hangs
• pnpm / yarn appear to work (they reuse cached artifacts or skip the failing build path)

Why this is happening

Node 23 is currently unsupported by secp256k1@4.x / eccrypto@4.x.

Recommended fix

Pin Node to LTS (18 or 20) or even 22 for now and document it explicitly.

Optional Guard

"engines": {
  "node": ">=18 <=22"
}

This makes npm, yarn, and pnpm all work.

[MantisClone]

@rodrigopavezi pointed out that part of the Commerce KYT Escrow development in the smart-contracts package, we now install a github repository instead of an actual NPM package - which works in yarn and pnpm. This might be what's causing the npm install to fail.

https://github.com/RequestNetwork/requestNetwork/blob/master/packages/smart-contracts/package.json#L62

"commerce-payments": "git+https://github.com/base/commerce-payments.git#v1.0.0",