Myp

This option also turned out to be quite working, for me it does not even require changing the Accept-Encoding, the key is to transfer Accept and sec-fetch-user.
 
headers: { //"User-Agent": "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8", //"Accept-Encoding": "gzip, deflate, br, zstd", "Accept-Language": "en-US,en;q=0.9", "sec-ch-ua": "\"Chromium\";v=\"140\", \"Not=A?Brand\";v=\"24\", \"Google Chrome\";v=\"140\"", "sec-ch-ua-mobile": "?1", "sec-ch-ua-platform": "\"Android\"", "sec-fetch-dest": "document", "sec-fetch-mode": "navigate", "sec-fetch-site": "same-origin", "sec-fetch-user": "?1", "upgrade-insecure-requests": "1" }

Here is a cleaner version if you encounter problems.
Still not working %100, randomly works.
As on some steamcommunity versions, that method would cause a crash.
if (this._options.request) {
    return reject(new Error('SteamCommunity.login() is incompatible with node-steamcommunity v3\'s usage of \'request\'. If you need to specify a custom \'request\' instance (e.g. when using a proxy), use https://www.npmjs.com/package/steam-session directly to log onto Steam.'));
}
 
const SteamCommunity = require('steamcommunity');   const community = new SteamCommunity();   // Patch before confirmations — login doesn't use this.request community.request = community.request.defaults({ headers: { 'Accept-Encoding': 'gzip, deflate, br' } });  

here is easy fix:
const request = require('request'); const SteamCommunity = require('steamcommunity'); let community = new SteamCommunity({ request: request.defaults({ headers: { 'Accept-Encoding': 'gzip, deflate, br' } }) }); if you use proxy:
request: request.defaults({ proxy: proxyUrl, headers: { 'Accept-Encoding': 'gzip, deflate, br' } })  
This is not rate limiting. Steam's WAF now fingerprints the Accept-Encoding request header. The legacy request package (which node-steamcommunity uses internally with gzip: true) sends exactly Accept-Encoding: gzip, deflate — real browsers always include br as well. Steam now rejects the bot-like values outright:
Accept-Encoding sent Response gzip, deflate (request lib default) 429 gzip 429 gzip, deflate, br 200 gzip, deflate, br, zstd 200 Same IP, same endpoint, seconds apart — only the header changes the outcome. api.steampowered.com is not affected.