extraneous emnapi/runtime@1.5.0 in Next.js 15 via Sharp cannot remove

[foobar-star]

Link to the code that reproduces this issue

https://codesandbox.io/p/sandbox/github/vercel/next.js/tree/canary/examples/reproduction-template?file=%2F.gitignore

To Reproduce

npx create-next-app@latest next-test
cd next-test
npm ls

next-test
├── @emnapi/runtime@1.5.0 extraneous
├── @tailwindcss/postcss@4.1.14
├── @types/node@20.19.19
├── @types/react-dom@19.2.0
├── @types/react@19.2.0
├── next@15.5.4
├── react-dom@19.1.0
├── react@19.1.0
├── tailwindcss@4.1.14
└── typescript@5.9.3

@emnapi/runtime@1.5.0 extraneous cannot be removed.

Current vs. Expected behavior

Current:
emnapi/runtime@1.5.0 shows up as an extraneous dependency immediately after installation.

Running npm uninstall emnapi/runtime@1.5.0 or other cleanup commands (npm prune, reinstalling, clearing caches) does not remove it.

The dependency remains in node_modules marked as extraneous, causing confusion and potential build/runtime issues.

This extraneous dependency cannot be removed without abandoning Next.js altogether.

Expected:
I expected a clean install with no extraneous dependencies listed post install

Provide environment information

---

**Environment:**

* OS: Debian (latest stable)
* Node.js: v22.x (LTS)
* npm: v10+
* Next.js: 15.5.4 (latest stable)

Which area(s) are affected? (Select all that apply)

create-next-app

Which stage(s) are affected? (Select all that apply)

next build (local)

Additional context

No response

[icyJoseph]

Kind of odd, but this started to happen in 15.2.0-canary.30 and that updated CNA to use Tailwind 4.

So I tried building a CNA app in latest without Tailwind, and then I don't get the extraneous dependency, neither in 15.2.0-canary.30 - but as soon as you use Tailwind 4, it happens.

Edit: Using eslint also causes this issue 🤔

[foobar-star]

Yes, I noticed that ESLint is adding the following extraneous package on my end when installed by itself without Tailwind:

@emnapi/runtime@1.5.0

This is the same extraneous package that shows up when installing Tailwind by itself and forgoing ESLint.

However, when choosing to install both ESLint and Tailwind using create-next-app, I get the following additional extraneous dependencies:

├── @emnapi/core@1.5.0 extraneous
├── @emnapi/runtime@1.5.0 extraneous
├── @emnapi/wasi-threads@1.1.0 extraneous
├── @eslint/eslintrc@3.3.1
├── @napi-rs/wasm-runtime@0.2.12 extraneous
├── @tailwindcss/postcss@4.1.14
├── @tybys/wasm-util@0.10.1 extraneous
├── @types/node@20.19.19
├── @types/react-dom@19.2.0
├── @types/react@19.2.0
├── eslint-config-next@15.5.4
├── eslint@9.36.0
├── next@15.5.4
├── react-dom@19.1.0
├── react@19.1.0
├── tailwindcss@4.1.14
└── typescript@5.9.3

Additionally, there’s a .package-lock.json file being added to the node_modules root directory. Was this always there?

node_modules/.package-lock.json

Anyway, I tried vigorously removing the extraneous packages and related post-install scripts like /.bin/napi-postinstall manually from the node_modules folder. After removing several packages, I cleared the cache and ran npm install again using the --prefer-online and --verbose flag to check for any errors or issues during build.

Then this popped up as an extraneous package:

@unrs-resolver
^ This also triggers calls to napi-postinstall.

Initially, I thought this was related to a post-install script, but I didn’t find any evidence of this.

The only thing that somewhat worked was manually removing sharp from node_modules, clearing the cache, and then installing sharp using npm install sharp --no-optional. This caused the WebAssembly extraneous dependencies to disappear entirely (though this may be related to a bug I found here: npm/cli#4828

However, I don’t think this is a proper solution since I’m not trying to use sharp as a direct dependency. Plus, the sharp docs and library recommend installing it with optional dependencies (unsure if this rule applies if its not being used as a direct dependency). Either way, these Sharp WebAssembly binaries are not expected behavior, according to the maintainer of the Sharp package: lovell/sharp#4442

_

The slightly longer explanation is that if and only if prebuilt binaries are not available for the current platform and if and only if an Emscripten development environment is detected, then Sharp will attempt to build WebAssembly binaries. This is used by Sharp's CI environment and occasionally for local development. No end users of Sharp are ever expected to be in this situation.

_

Some optional dependencies related to ESLint and Tailwind are interacting strangely with the native WebAssembly binaries from Sharp, causing them to build. This is definitely odd behavior.

It’s a bit unsettling to see WebAssembly binaries appearing to act on their own accord. It's especially unsettling when it does so silently.

Another workaround is to install everything without Tailwind and ESLint first, then add them later with the --no-optional flag. This also seems to exclude the extraneous WebAssembly dependencies. However, I’m not sure how these solutions would help if you didn’t install cleanly the first time (which isn’t even possible with the create-next-app prompt if selecting Tailwind, ESLint, or either one). It’s easy to miss this issue if you didn’t notice it right away.

[icyJoseph]

This doesn't happen with pnpm right? pnpm blocks this, and you have to manually say, approve-builds.

[foobar-star]

Yes, when using ESlint and Tailwind together pnpm blocks the following:

Tailwindcss/oxide, Sharp, and UNRS-Resolver

The napi-postinstall script is also not present in the .bin of the node_modules as well when using pnpm create next-app@latest my-next-app instead of npx create-next-app@latest my-next-app.

[icyJoseph]

I wonder if there's anything Next.js can really do here though? I know we have been talking about not allowing this kind of post install scripts for any package manager, via --ignore-scripts or the like, but, these would come back the moment the user allows/runs post install anyway?

[foobar-star]

Well no there is nothing you can do about the tailwind behaivor I am certain of that.

However, unrs-resolver is being used by your Eslint configuration I believe e.g., eslint-config-next: 15.5.4
which uses the unrs-resolver as a dependency which creates that persistence of the WebAssembly (WA) binaries post install

If I try installing ESlint alongside Sharp in other projects without this package: eslint-config-next: 15.5.4 their is no issue.

The unrs-resolver is also apart of what is causing the persistence and making clean up commands like npm prune etc fail to remove the unwanted WebAssembly.

I suspect this is an issue directly pertaining to Sharps detection of emscripten environments so let me touch base with the maintainer to see if he also concurs and if their is a potential solution so everyone can install next.js
without unwanted WebAssembly if they also desire to use Tailwind or Eslint in their project.

As far as using the flag --ignore-scripts that does not appear to matter since @tailwindcss/postcss@4.1.14 and eslint-config-next.js will not respect this flag and will install their post install scripts anyway via their optional deps which is tailwind/oxide and unrs-resolver (used by eslint-config-next.js).

Example --ignore-scripts flag with eslint-config-next@15.5.4:

➜ workspace git:(main) npm install --ignore-scripts

added 284 packages, and audited 285 packages in 6s

128 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities


➜  workspace git:(main) ✗ npm ls
nodejs-sandbox@1.0.0 /project/workspace
├── @emnapi/runtime@1.5.0 extraneous
├── eslint-config-next@15.5.4
├── sharp@0.34.4
└── tslib@2.8.1 extraneous

Example without eslint-config-next@15.5.4 installed:

➜  workspace git:(main) ✗ npm ls
nodejs-sandbox@1.0.0 /project/workspace
├── @eslint/eslintrc@3.3.1
├── @types/react-dom@19.2.1
├── @types/react@19.2.2
├── eslint@9.37.0
├── sharp@0.34.4
├── tailwindcss@4.1.14
└── typescript@5.9.3

Example of using @tailwindcss/postcss@4.1.14 with --ignore-scripts:

➜  workspace git:(main) ✗ npm install @tailwindcss/postcss@4.1.14 --ignore-scripts

added 29 packages, and audited 128 packages in 3s

33 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

➜  workspace git:(main) ✗ npm ls
nodejs-sandbox@1.0.0 /project/workspace
├── @emnapi/runtime@1.5.0 extraneous
├── @eslint/eslintrc@3.3.1
├── @tailwindcss/postcss@4.1.14
├── @types/react-dom@19.2.1
├── @types/react@19.2.2
├── eslint@9.37.0
├── sharp@0.34.4
├── tailwindcss@4.1.14
├── tslib@2.8.1 extraneous
└── typescript@5.9.3

Only the flag --no-optional would be effective since --ignore-scripts is not respected by either eslint-config-next@15.5.4 or @tailwindcss/postcss@4.1.14 via tailwind/oxide and unrs-resolver

workspace git:(main) ✗ npm install --no-optional
npm WARN config optional Use `--omit=optional` to exclude optional dependencies, or
npm WARN config `--include=optional` to include them.
npm WARN config 
npm WARN config     Default value does install optional deps unless otherwise omitted.

added 119 packages, and audited 120 packages in 7s

28 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

➜  workspace git:(main) ✗ npm ls
nodejs-sandbox@1.0.0 /project/workspace
├── @eslint/eslintrc@3.3.1
├── @tailwindcss/postcss@4.1.14
├── @types/react-dom@19.2.1
├── @types/react@19.2.2
├── eslint@9.37.0
├── sharp@0.34.4
├── tailwindcss@4.1.14
└── typescript@5.9.3

I will bring this issue up to the maintainers of Sharp to confirm from their end.