isaacs/npm — Issue #1971: npm install chmods existing npm.prefix folder
Author: jonmz
Created: 2011-12-30 11:05:22+00:00
State: open

This seems to be some kind of a duplicate of #1509, however I can still reproduce an unnecessary chmod of the npm.prefix folder when _installing_ modules with the current 1.0.106 release.

#1509 was talking about ```npm config get ...``` which had a chmod of the npm.prefix as a side effect, which was bad if you ran npm in, e.g., your home directory. This seems to be fixed.

However, when _installing_ a module, npm still shows the existing behaviour:

[dummy@lyra ~]$ npm -v
1.0.106

[dummy@lyra ~]$ ls -ld ~
drwx------ 16 dummy dummy 4096 Dec 30 11:25 /home/dummy

[dummy@lyra ~]$ npm install fibers --verbose
npm info it worked if it ends with ok
...
npm verb config file /home/dummy/.npmrc
npm verb config file /package/host/localhost/nodejs-0.6/etc/npmrc
npm verb config file /home/dummy/lib/node_modules/npm/npmrc
npm verb mkdir done: /home/dummy 755
npm verb into /home/dummy [ 'fibers' ]
...
npm info ok

[dummy@lyra ~]$ ls -ld ~
drwxr-xr-x 16 dummy dummy 4096 Dec 30 11:25 /home/dummy

One might argue that it's a really bad idea to install a node module into one's home directory - which is totally true; you shouldn't do that. I have, however, a strong belief that npm shouldn't chmod an already existing prefix in _any_ case.

The fact that npm installs modules locally to a specific application obviously is quite surprising for many users, especially for users coming from other languages. Whether you use Perl's cpan, or Python's easy_install or pip, or Ruby's gem: In any case modules get installed in some library directory beneath the user's home directory, locally to the user, but globally to that user's applications (speaking in npm's terms of "local" and "global"). I really see the benefits of the different concept here, and I'm really not naming it "bad" - but "surprising".

In fact, on our hosting systems we have noticed _that_ many chmod-755'ed home directories (which we create as 700 by default) that we created a cronjob checking and fixing their permissions, sending out automated mailing to the users in question asking them what they have been doing what _might_ have caused this (we offer quite a lot of programming languages, and node.js users are the minority, so it really wasn't clear what happened) - practically every response contained some npm install calls.

While it's true that ```npm install ...``` in the home directory is a bad idea, npm really makes it ways too easy to let users shoot themselves in their foot. I'd really appreciate if that behaviour could be changed.