Can "NPM -i" (local) install a global package without i know it?

Question

I'm ok with local dependencies that packages install. But now I have a huge concerns about if a local installed package can install other global packages as dependencies.

as example:

npm install nunjucks npm install sqlite or npm install botkit

Answer 1

It is not possible to mark a dependency as global in package.json, so that it is installed system-wide when you run npm i.

Here's an old comment by Isaac Schlueter stating that this will never be implemented.

Hooowever, it would be really simple to write a preinstall script to install arbitary dependencies globally.

{
  "name": "Project",
  "version": "1.0.0",
  "description": "Preinstall script to install global deps",
  "main": "index.js",
  "scripts": {
    "preinstall": "node -e \"const {execSync} = require('child_process'); JSON.parse(fs.readFileSync('package.json')).globalDependencies.forEach(globalDep => execSync('npm i -g ' + globalDep));\""
  },
  "dependencies": {
    "react": "16.13.1"
  },
  "globalDependencies": [
    "lodash"
  ],
  "license": "ISC"
}

Copy this code into a package.json file in a folder on your PC. Then, in the folder run npm i. It will install React locally (in a node_modules folder) and it will install lodash globally.

You can verify this using: npm i ls -g --depth=0.

Reference: Install dependencies globally and locally using package.json

As to your question:

Can npm -i (local) install a global package without me knowing it?

It's not entirely silent. When running npm i for the above package.json file, you would see the following output:

> Project@1.0.0 preinstall /home/jim/Desktop/Project
> node -e "const {execSync} = require('child_process'); JSON.parse(fs.readFileSync('package.json')).globalDependencies.forEach(globalDep => execSync('npm i -g ' + globalDep));"

npm WARN Project@1.0.0 No repository field.

audited 6 packages in 1.113s
found 0 vulnerabilities

But whether you would catch this when running npm i on a large project is debatable.