Describe the issue

onnxruntime-node fails during postinstall when the NuGet service index endpoint returns an HTTP 302 redirect.

This is reproducible with onnxruntime-node@1.24.3 as a transitive dependency of gitnexus.

The current installer appears to reject non-200 responses while downloading the build list:

Error: Failed to download build list. HTTP status code = 302
    at ClientRequest.<anonymous> (.../node_modules/onnxruntime-node/script/install-utils.js:57:18)

In my environment, https://api.nuget.org/v3/index.json returns a redirect first:

$ curl -I https://api.nuget.org/v3/index.json
HTTP/1.1 302 Redirect
Location: https://nuget.azure.cn/v3/index.json

Following redirects succeeds:

$ curl -I -L https://api.nuget.org/v3/index.json
HTTP/1.1 302 Redirect
Location: https://nuget.azure.cn/v3/index.json

HTTP/2 200
content-type: application/json
content-length: 9251

According to the NuGet Server API documentation, NuGet API requests may return HTTP 301 or 302, and clients should gracefully follow the Location header and issue a subsequent GET.

Therefore, this seems to be a robustness issue in the onnxruntime-node install script rather than a package registry issue. The script should follow 301/302 redirects when fetching the NuGet service index / build list.

To reproduce

node -v
# v22.22.2

npm install -g gitnexus

The install fails during the transitive onnxruntime-node postinstall step:

npm error path .../node_modules/gitnexus/node_modules/onnxruntime-node
npm error command failed
npm error command sh -c node ./script/install
npm error Error: Failed to download build list. HTTP status code = 302
npm error Node.js v22.22.2

A minimal Node.js HEAD request also observes the first-hop redirect:

const https = require('https');

const req = https.request(
  'https://api.nuget.org/v3/index.json',
  { method: 'HEAD' },
  res => {
    console.log('status =', res.statusCode);
    console.log('location =', res.headers.location || '');
  }
);

req.on('error', console.error);
req.end();

Output:

status = 302
location = https://nuget.azure.cn/v3/index.json

Expected behavior

onnxruntime-node's install script should follow HTTP 301/302 redirects for metadata downloads and continue installation if the redirected URL returns 200 OK.

Actual behavior

The install script rejects the 302 response directly and aborts the npm installation.

Suggested fix

In js/node/script/install-utils.js, follow redirects when downloading the build list, ideally with a redirect limit to avoid infinite loops.

For example:

if ([301, 302, 303, 307, 308].includes(statusCode) && response.headers.location) {
  return resolve(downloadBuildList(
    new URL(response.headers.location, url).toString(),
    redirectCount + 1
  ));
}

Alternatively, use a fetch/client implementation that follows redirects by default for GET requests.

Workaround

This can be worked around by skipping the install step:

ONNXRUNTIME_NODE_INSTALL=skip npm install -g gitnexus

However, that is not a real fix for users who need the native onnxruntime-node runtime installed correctly.

Environment

• OS: Ubuntu Server
• Node.js: v22.22.2
• npm registry: https://registry.npmmirror.com
• Package: onnxruntime-node@1.24.3
• Installation path: transitive dependency of gitnexus

Related issue

This looks related to #25293, but that issue was framed as a Docker build failure. This issue is specifically about handling NuGet's documented 301/302 redirect behavior in the Node.js install script.

### Urgency

_No response_

### Platform

Linux

### OS Version

Ubuntu 24.04.4 LTS

### ONNX Runtime Installation

Other / Unknown

### ONNX Runtime Version or Commit ID

onnxruntime-node@1.24.3

### ONNX Runtime API

Other / Unknown

### Architecture

X64

### Execution Provider

Other / Unknown

### Execution Provider Library Version

_No response_