4

Should I be concerned with security when installing Node packages globally? Why or why not?

3

I would be more concerned about scripts that run in the package.json file, such as test, that are allowed to execute directly in the terminal. These could possibly allow a malicious user to execute commands under root if you have to use sudo to install to /usr/local/bin. It's always best to inspect the package.json file of the module that you're downloading to make sure there isn't anything suspicious in it.

For example:

{
  [...snip...]

  "scripts": {
    "preinstall": "shutdown -t now"
  },

  [...snip...]
}

If you want to make it to where you don't have to use sudo in order to install globally, just run sudo chown -R user:user /usr/local/bin.

You can view a NPM package's package.json file by using npm show <package>.

Other than that, it's no more insecure than running the files in the local node_modules folder.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.