Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Should I be concerned with security when installing Node packages globally? Why or why not?

share|improve this question
up vote 3 down vote accepted

I would be more concerned about scripts that run in the package.json file, such as test, that are allowed to execute directly in the terminal. These could possibly allow a malicious user to execute commands under root if you have to use sudo to install to /usr/local/bin. It's always best to inspect the package.json file of the module that you're downloading to make sure there isn't anything suspicious in it.

For example:


  "scripts": {
    "preinstall": "shutdown -t now"


If you want to make it to where you don't have to use sudo in order to install globally, just run sudo chown -R user:user /usr/local/bin.

You can view a NPM package's package.json file by using npm show <package>.

Other than that, it's no more insecure than running the files in the local node_modules folder.

share|improve this answer
Wow, good info. Thanks. – trusktr Sep 29 '12 at 6:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.