Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Should I be concerned with security when installing Node packages globally? Why or why not?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

I would be more concerned about scripts that run in the package.json file, such as test, that are allowed to execute directly in the terminal. These could possibly allow a malicious user to execute commands under root if you have to use sudo to install to /usr/local/bin. It's always best to inspect the package.json file of the module that you're downloading to make sure there isn't anything suspicious in it.

For example:

{
  [...snip...]

  "scripts": {
    "preinstall": "shutdown -t now"
  },

  [...snip...]
}

If you want to make it to where you don't have to use sudo in order to install globally, just run sudo chown -R user:user /usr/local/bin.

You can view a NPM package's package.json file by using npm show <package>.

Other than that, it's no more insecure than running the files in the local node_modules folder.

share|improve this answer
    
Wow, good info. Thanks. –  trusktr Sep 29 '12 at 6:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.