Bundled terminal-notifier (and notifu*.exe) shipped without executable bit → spawn EACCES on macOS

[endelwar]

The npm-published tarball of toasted-notifier@10.1.0 ships the bundled native binaries without the executable permission bit, so notifications fail at runtime on macOS with:

spawn .../node_modules/toasted-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/MacOS/terminal-notifier EACCES

Root cause

Comparing the file mode bits inside the published tarballs (tar -tvzf), the vendored binaries were published as 0644 instead of 0755:

file	node-notifier@9.0.1	toasted-notifier@10.1.0
vendor/mac.noindex/terminal-notifier.app/Contents/MacOS/terminal-notifier	-rwxr-xr-x	-rw-r--r-- ❌
vendor/notifu/notifu.exe	-rwxr-xr-x	-rw-r--r--
vendor/notifu/notifu64.exe	-rwxr-xr-x	-rw-r--r--

The upstream node-notifier ships these 0755. npm publish packs files with whatever mode they have on disk at pack time, so the exec bit was already missing before publish — this is not a consumer/Yarn issue (Yarn extracts the modes faithfully).

Steps to reproduce

const notifier = require('toasted-notifier');
notifier.notify({ title: 'Test', message: 'Hello' }, (err) => console.log(err && err.message));
// => spawn .../terminal-notifier EACCES  (on macOS)

Suggested fix

Restore the executable bit on the vendored binaries before publishing — e.g. chmod +x them in a prepack / prepublishOnly script, or commit them with mode 0755, then verify with:

npm pack
tar -tvzf toasted-notifier-*.tgz | grep -E 'terminal-notifier$|notifu.*\.exe$'

Expected: -rwxr-xr-x on terminal-notifier, notifu.exe, notifu64.exe.

Workaround for consumers meanwhile

"scripts": {
  "postinstall": "node -e \"try{require('fs').chmodSync('node_modules/toasted-notifier/vendor/mac.noindex/terminal-notifier.app/Contents/MacOS/terminal-notifier',0o755)}catch(e){}\""
}

Environment: macOS, Node.js 24, toasted-notifier@10.1.0 (installed via webpack-notifier → node-notifier alias).