The 'npm run start' command exits with file not found error

[OnkarRuikar]

Summary

The npm run start is not starting the local server.

Problem

I am getting the following error every time I pull remote and run the command:

$ npm run start
npm notice run @mdn/content@1.0.0 start
npm notice run npm run --silent info:fred && npm run up-to-date-check && env-cmd --silent cross-env CONTENT_ROOT=files NODE_ENV=production FRED_PLAYGROUND_LOCAL=true FRED_PLAYGROUND_PORT=5043 FRED_PORT=5042 FRED_WRITER_MODE=true fred server

🐥 This command is using Fred: https://github.com/mdn/fred
🐞 Please report issues here:  https://github.com/mdn/fred/issues/new?template=bug.yml

npm notice run @mdn/content@1.0.0 up-to-date-check
npm notice run node scripts/up-to-date-check.js
[rari] /bin/sh: 1: /home/userme/GitHub/mdn/content/node_modules/@mdn/rari/bin/rari: not found
[rari] "/home/userme/GitHub/mdn/content/node_modules/@mdn/rari/bin/rari" serve -vv exited with code 127
--> Sending SIGTERM to other processes..
[server] node "/home/userme/GitHub/mdn/content/node_modules/@mdn/fred/server.js" exited with code SIGTERM
All tasks completed successfully.
node:internal/process/promises:392
      new UnhandledPromiseRejection(reason);
      ^

UnhandledPromiseRejection: This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). The promise rejected with the reason "[object Array]".
    at throwUnhandledRejectionsMode (node:internal/process/promises:392:7)
    at processPromiseRejections (node:internal/process/promises:475:17)
    at process.processTicksAndRejections (node:internal/process/task_queues:106:37) {
  code: 'ERR_UNHANDLED_REJECTION'
}

Node.js v24.20.0

From the logs, and I checked manually, the node_modules/@mdn/rari/bin/rari file is not being created by npm install and npm ci executions.

This is because:

Starting with npm v12, GitHub implemented a major security change: all lifecycle scripts (like preinstall, install, and postinstall) are turned off by default to block malicious supply-chain code execution.

The following scripts should be added to allow list:

$ npm install-scripts ls
5 packages have install scripts blocked because they are not covered by allowScripts:
  @mdn/rari@0.2.34 (postinstall: node ./lib/postinstall.js)
  gifsicle@5.3.0 (postinstall: node lib/install.js)
  lefthook@2.1.12 (postinstall: node postinstall.js)
  mozjpeg@8.0.0 (postinstall: node lib/install.js)
  pngquant-bin@9.0.0 (postinstall: node lib/install.js)

Run `npm install-scripts approve <pkg>` to allow, or `npm install-scripts deny <pkg>` to deny.

Solution

Either one of the following:

1. Add the following to package.json:

    "allowScripts": {
       "@mdn/rari": true,
       "gifsicle": true,
       "lefthook": true,
       "mozjpeg": true,
       "pngquant-bin": true
     }
   

2. Add the following to the .npmrc file:

allow-scripts=@mdn/rari,gifsicle,lefthook,mozjpeg,pngquant-bin

3. Update the contributing document to add the above line to the global config ~/.npmrc file.

[Josh-Cena]

@mdn/engineering

[caugner]

What npm version are you using?

Node 24.20 comes with npm 11.19.0, and content's .nvmrc points to Node 24.14 which comes with npm 11.12.1. These versions shouldn't prevent scripts from running yet.

If rari download failed during install, npm ci might help you recover?

[OnkarRuikar]

I am using Node.js v24.20.0.

If rari download failed during install, npm ci might help you recover?

I have tried npm ci. It is not a package download fail issue. Rari ships with only lib directory. The rari postinstall script compiles the node_modules/@mdn/rari/bin/rari binary on the spot.

[caugner]

I am using Node.js v24.20.0.

That doesn't necessarily mean you run the bundled npm version.

Are you still experiencing this issue?

[caugner]

@OnkarRuikar What happens if you checkout 928cf96a2b7428c5819428832bde66cad1da9e54^, the content commit prior to the latest Fred bump? Otherwise you could also use git bisect and use HEAD as the bad commit and main@{'1 week ago'} as the good commit, then run npm ci and npm start on every bisected commit, and mark the bisected commit as good or bad accordingly.

Note that the rari postinstall "only" downloads the rari binary for your OS from the corresponding rari GitHub release, it doesn't compile it.