0

Following instructions here: npm throws error without sudo

I went ahead and run the following command in the terminal (admittedly I should have been more cautious):

sudo chown -R $(whoami) ~/.npm

Being new to these sort of commands, I'm now concerned that this may have caused a security issue on my system.

Is there anything I should be concerned about? If so, any way to fix it?

Thank you in advance.

Community
  • 1
  • 1
Richard
  • 1,414
  • 2
  • 16
  • 27

1 Answers1

1

No, ~/.npm is already in your home folder hence the ~ character. If you require sudo to install npm modules then you probably have node and npm install system wide. When you do this it puts the application data into /usr/local path, because this path is in your $PATH which means you shell looks for executables there. Its also readable by all users, so all users can use node/npm. You're not creating a security flaw with what you've done. You would, however, create a minor security problem if you were to chown your /usr/local/ directory. If you chown just the node_module global directory you wouldn't really create much of a security problem, but it would likely mean that you should just install node/npm on your user's account(in your home directory) where you have write access.

NVM is useful for this, it installs node/npm to your user account and adds its install path to your $PATH in your .bashrc. I don't recommend using NVM in production however, production is another ball game altogether, where you should probably learn how to create system services/daemons appropriately.

tsturzl
  • 3,089
  • 2
  • 22
  • 35
  • Ah got it. I did uninstall node after I had done this and reinstalled it successfully. Would that have overwritten that 'chow' command? – Richard Dec 09 '15 at 03:13
  • Also, what kind of 'minor security' problem would there be by selecting, '/usr/local/' ? Thank you – Richard Dec 09 '15 at 03:13
  • There was nothing wrong with the command you ran, it essentially did nothing. Chowning /usr/local would mean that anyone who compromised that user account would have full access to that directory. That directory has many files and binaries that are required for a system to run properly. This all assumes that the file owners account got compromised. Its still not of your concern because that isn't what do you did. You basically didn't even do anything everything in your home directory `~` is already owned by you. – tsturzl Dec 09 '15 at 04:01