In reply to @h7x4:nani.wtf
No worries 😄 Ping me if you'd like the package file with the current failing setup.

I've bundled a patch, likely introducing IFD, but good enough for testing.

{ lib
, buildNpmPackage
, fetchNpmDeps
, fetchFromGitea
, git
, cacert

, writeText
}:
# Smaller version of the problem
# fetchNpmDeps {
#   name = "out-of-your-element-deps";
#   src = fetchFromGitea {
#     domain = "gitdab.com";
#     owner = "cadence";
#     repo = "out-of-your-element";
#     rev = "v1.3";
#     hash = "sha256-dLDm3xOMoprkGU7D9IFX1hjMfCR3YjVgXb3c5IEuUTQ";
#   };

#   patches = [ ./add-discord-markdown-dep-integrity.patch ];

  # npmDepsHash = "sha256-k2MeejRWteIzY1Q+iNLCLDLnE1z9+cBaAGYAIlQHa/4=";
# };
buildNpmPackage rec {
  pname = "out-of-your-element";
  version = "1.3";
  src = fetchFromGitea {
    domain = "gitdab.com";
    owner = "cadence";
    repo = "out-of-your-element";
    rev = "v${version}";
    hash = "sha256-dLDm3xOMoprkGU7D9IFX1hjMfCR3YjVgXb3c5IEuUTQ";
  };

  patches = [ (writeText "add-discord-markdown-dep-integrity.patch" ''
    diff --git i/package-lock.json w/package-lock.json
    index 3847ee1..79a3ac0 100644
    --- i/package-lock.json
    +++ w/package-lock.json
    @@ -1060,6 +1060,7 @@
         "node_modules/discord-markdown": {
           "version": "2.4.1",
           "resolved": "git+https://git.sr.ht/~cadence/nodejs-discord-markdown#abc56d544072a1dc5624adfea455b0e902adf7b3",
    +      "integrity": "sha512-mPjPXXNgL3prKagvj/guOzAEMcJdcr6S95u7MRlYZvsgeUiacQDQatYrJgYAf53vJw+U0JvEPUwRHZY02oX1og==",
           "license": "MIT",
           "dependencies": {
             "simple-markdown": "^0.7.2"
  '') ];

  dontNpmBuild = true;
  npmDepsHash = "sha256-fPTFyX2GYSdMeIzVKXBacZxhTTj8fvlMFEGOxN0/cm8=";

  meta = with lib; {
    homepage = "https://gitdab.com/cadence/out-of-your-element";
    description = "Modern Matrix-to-Discord appservice bridge";
    changelog = "https://gitdab.com/cadence/out-of-your-element/releases/tag/${src.rev}";
    license = licenses.agpl3Plus;
    mainProgram = "start.js";
  };
}

cryptpad> Installing dependencies
cryptpad> ++ npm ci --ignore-scripts --loglevel=verbose
cryptpad> npm verb cli /nix/store/d6lkbndr98lcn8spbqxfq52f2ldvqhks-nodejs-20.11.0/bin/node /nix/store/d6lkbndr98lcn8spbqxfq52f2ldvqhks-nodejs-20.11.0/bin/npm
cryptpad> npm info using npm@10.2.4
cryptpad> npm info using node@v20.11.0
cryptpad> npm verb logfile could not create logs-dir: Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs'
cryptpad> npm verb title npm ci
cryptpad> npm verb argv "ci" "--ignore-scripts" "--loglevel" "verbose"
cryptpad> npm verb logfile logs-max:10 dir:/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs/2024-01-29T22_44_13_405Z-
cryptpad> npm verb logfile could not be created: Error: ENOENT: no such file or directory, open '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs/2024-01-29T22_44_13_405Z-debug-0.log'
cryptpad> npm verb logfile no logfile created
cryptpad> npm WARN EBADENGINE Unsupported engine {
cryptpad> npm WARN EBADENGINE   package: 'json.sortify@2.2.2',
cryptpad> npm WARN EBADENGINE   required: { node: '>=4.0.0', npm: '~1.0.20' },
cryptpad> npm WARN EBADENGINE   current: { node: 'v20.11.0', npm: '10.2.4' }
cryptpad> npm WARN EBADENGINE }
cryptpad> npm WARN deprecated debuglog@0.0.2: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
cryptpad> npm WARN deprecated flatten@1.0.3: flatten is deprecated in favor of utility frameworks such as lodash.
cryptpad> npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
cryptpad> npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
cryptpad> npm WARN deprecated lex@1.7.9: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
cryptpad> npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
cryptpad> npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
cryptpad> npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
cryptpad> npm verb stack Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp'
cryptpad> npm verb cwd /build/source
cryptpad> npm verb Linux 6.1.69
cryptpad> npm verb node v20.11.0
cryptpad> npm verb npm  v10.2.4
cryptpad> npm ERR! code EACCES
cryptpad> npm ERR! syscall mkdir
cryptpad> npm ERR! path /nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp
cryptpad> npm ERR! errno -13
cryptpad> npm verb Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp' 
cryptpad> npm ERR! 
cryptpad> npm ERR! Your cache folder contains root-owned files, due to a bug in
cryptpad> npm ERR! previous versions of npm which has since been addressed.
cryptpad> npm ERR! 
cryptpad> npm ERR! To permanently fix this problem, please run:
cryptpad> npm ERR!   sudo chown -R 1000:100 "/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps"
cryptpad> npm verb exit -13
cryptpad> npm verb unfinished npm timer reify 1706568253643
cryptpad> npm verb unfinished npm timer reify:unpack 1706568253668
cryptpad> npm verb unfinished npm timer reifyNode:node_modules/drawio 1706568253673
cryptpad> npm verb code -13
cryptpad> 
cryptpad> npm ERR! Log files were not written due to an error writing to the directory: /nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs
cryptpad> npm ERR! You can rerun the command with `--loglevel=verbose` to see the logs in your terminal
cryptpad> ++ echo

In reply to @hexa:lossy.network

cryptpad> Installing dependencies
cryptpad> ++ npm ci --ignore-scripts --loglevel=verbose
cryptpad> npm verb cli /nix/store/d6lkbndr98lcn8spbqxfq52f2ldvqhks-nodejs-20.11.0/bin/node /nix/store/d6lkbndr98lcn8spbqxfq52f2ldvqhks-nodejs-20.11.0/bin/npm
cryptpad> npm info using npm@10.2.4
cryptpad> npm info using node@v20.11.0
cryptpad> npm verb logfile could not create logs-dir: Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs'
cryptpad> npm verb title npm ci
cryptpad> npm verb argv "ci" "--ignore-scripts" "--loglevel" "verbose"
cryptpad> npm verb logfile logs-max:10 dir:/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs/2024-01-29T22_44_13_405Z-
cryptpad> npm verb logfile could not be created: Error: ENOENT: no such file or directory, open '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs/2024-01-29T22_44_13_405Z-debug-0.log'
cryptpad> npm verb logfile no logfile created
cryptpad> npm WARN EBADENGINE Unsupported engine {
cryptpad> npm WARN EBADENGINE   package: 'json.sortify@2.2.2',
cryptpad> npm WARN EBADENGINE   required: { node: '>=4.0.0', npm: '~1.0.20' },
cryptpad> npm WARN EBADENGINE   current: { node: 'v20.11.0', npm: '10.2.4' }
cryptpad> npm WARN EBADENGINE }
cryptpad> npm WARN deprecated debuglog@0.0.2: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
cryptpad> npm WARN deprecated flatten@1.0.3: flatten is deprecated in favor of utility frameworks such as lodash.
cryptpad> npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
cryptpad> npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
cryptpad> npm WARN deprecated lex@1.7.9: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
cryptpad> npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
cryptpad> npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
cryptpad> npm WARN deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
cryptpad> npm verb stack Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp'
cryptpad> npm verb cwd /build/source
cryptpad> npm verb Linux 6.1.69
cryptpad> npm verb node v20.11.0
cryptpad> npm verb npm  v10.2.4
cryptpad> npm ERR! code EACCES
cryptpad> npm ERR! syscall mkdir
cryptpad> npm ERR! path /nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp
cryptpad> npm ERR! errno -13
cryptpad> npm verb Error: EACCES: permission denied, mkdir '/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_cacache/tmp' 
cryptpad> npm ERR! 
cryptpad> npm ERR! Your cache folder contains root-owned files, due to a bug in
cryptpad> npm ERR! previous versions of npm which has since been addressed.
cryptpad> npm ERR! 
cryptpad> npm ERR! To permanently fix this problem, please run:
cryptpad> npm ERR!   sudo chown -R 1000:100 "/nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps"
cryptpad> npm verb exit -13
cryptpad> npm verb unfinished npm timer reify 1706568253643
cryptpad> npm verb unfinished npm timer reify:unpack 1706568253668
cryptpad> npm verb unfinished npm timer reifyNode:node_modules/drawio 1706568253673
cryptpad> npm verb code -13
cryptpad> 
cryptpad> npm ERR! Log files were not written due to an error writing to the directory: /nix/store/48frifr851cd9xz2siwzz1dsqnlz757w-cryptpad-5.6.0-npm-deps/_logs
cryptpad> npm ERR! You can rerun the command with `--loglevel=verbose` to see the logs in your terminal
cryptpad> ++ echo

In reply to @hexa:lossy.network
indeed it does

cryptpad-5.6.0 (installPhase) ⏱ 7m41s