How/why does npm recommend not running as root? - node.js

Question

In short...
First of all, why does npm suggest that it should only run as non-root? I highly disbelieve that every other package manager (apt, yum, gem, pacman) is wrong for requiring sudo.
Second, when I follow their suggestion (and run npm install as non-root), it won't work (because non-root doesn't have permission to /usr/local/lib). How do I follow their suggestion? I am not going to chown -R $USER /usr/local/lib, because that seems like a very bad idea to me.
Full description...
I installed npm via curl http://npmjs.org/install.sh | sudo sh (the instruction in their README).
When I run sudo npm install mongoose, npm tells me not to run it as root:
npm ERR! sudon't!
npm ERR! sudon't! Running npm as root is not recommended!
npm ERR! sudon't! Seriously, don't do this!
npm ERR! sudon't!
But when I run npm install mongoose without sudo I get the following:
npm info it worked if it ends with ok
npm info using npm#0.2.17
npm info using node#v0.4.0-pre
npm info fetch http://registry.npmjs.org/mongoose/-/mongoose-1.0.7.tgz
npm info calculating sha1 /tmp/npm-1297199132405/1297199132406-0.7044695958029479/tmp.tgz
npm info shasum b3573930a22066fbf3ab745a79329d5eae75b8ae
npm ERR! Could not create /usr/local/lib/node/.npm/.cache/mongoose/1.0.7/package.tgz
npm ERR! Failed creating the tarball.
npm ERR! This is very rare. Perhaps the 'gzip' or 'tar' configs
npm ERR! are set improperly?
npm ERR!
npm ERR! couldn't pack /tmp/npm-1297199132405/1297199132406-0.7044695958029479/contents/package to /usr/local/lib/node/.npm/.cache/mongoose/1.0.7/package.tgz
npm ERR! Error installing mongoose#1.0.7
npm ERR! Error: EACCES, Permission denied '/usr/local/lib/node/.npm/.cache/mongoose'
npm ERR! There appear to be some permission problems
npm ERR! See the section on 'Permission Errors' at
npm ERR! http://github.com/isaacs/npm#readme
npm ERR! This will get better in the future, I promise.
npm not ok
So it tells me I shouldn't use sudo, and then doesn't work if I follow their suggestion.
Which leads to my initial questions above.

Answer 1

Actually, npm does not recommend not running as root. Well, not any more.
It has changed around the same time that you asked your question. This is how the README looked like on February 7, 2011: "Using sudo with npm is Very Not Recommended. Anyone can publish anything, and package installations can run arbitrary scripts." It was explained later in more detail as "Option 4: HOLY COW NOT RECOMMENDED!! You can just use sudo all the time for everything, and ignore the incredibly obnoxious warnings telling you that you're insane for doing this."
See: https://github.com/isaacs/npm/tree/7288a137f3ea7fafc9d4e7d0001a8cd044d3a22e#readme
Now it is actually considered a recommended technique of installing npm:
Simple Install - To install npm with one command, do this:
curl http:/ /npmjs.org/install.sh | sudo sh
See: https://github.com/isaacs/npm/tree/99f804f43327c49ce045ae2c105995636c847145#readme
My advice would be to never do it because it means basically this:
find out what the local DNS (or anyone else spoofing the DNS response or poisoning the DNS cache) says is the IP address of npmjs.org
connect with insecure TCP with that IP (or with whoever says it's his IP) on port 80
trust the router that you think you should talk to (or anyone who gave you the DHCP response said you should talk to) to deliver packets to the right host
possibly go through another layer of transparent caching proxy
trust all other networks between you and the other end of the TCP connection
don't know for sure who you are connected with
cross your fingers
request install.sh script over insecure HTTP with no verification whatsoever
and then run whatever was returned by whoever you're talking to with maximum privileges on your machine without even checking what is it.
As you can see this is really, literally, with no exaggeration giving root shell to whatever you get after asking for a script from the Internet over an insecure connection with no verification whatsoever. There are at least 5 different things that can go wrong here, any of which can lead to an attacker taking total control over your machine:
DHCP spoofing
ARP spoofing
DNS cache poisoning
DNS response spoofing
TCP session hijacking
Also note that using 'sh' instead of 'sudo sh' is usually not any less risky unless you run it as a different user who doesn't have access to your private data, which is usually not the case.
You should use HTTPS connections if available to download such scripts so you could at least verify who you are talking to, and even then I wouldn't run it without reading first. Unfortunately npmjs.org has a self-signed certificate so it doesn't really help in this case.
Fortunately npm is available on GitHub that has a valid SSL certificate and from where you can download it using secure connection. See: github.com/isaacs/npm for details. But make sure that the npm itself doesn't use insecure connections to download the files that it downloads - there should be an option in npm config.
Hope it helps. Good luck!

Answer 2

The simple answer is web servers should never be run as root for well known security reasons, so this goes for npm commands as well.
To start fresh, remove prior Node.js and npm installs as well as these files/directories:
mv ~/.npmrc ~/.npmrc~prior
mv ~/.npm ~/.npm~prior
mv ~/tmp ~/tmp.~prior
mv ~/.npm-init.js ~/.npm-init.js~prior
Solution: Install Node.js (which comes with npm) as NON root (no sudo)
Download Source Code directly from https://nodejs.org/en/download/
Execute the below as yourself (Linux/OS X)
cd node-v8.1.2 # into expanded source dir
export NODE_PARENT=${HOME}/node-v8.1.2 # put this into your ~/.bashrc
Feel free to change above export to whatever location is appropriate
./configure --prefix=${NODE_PARENT}
make -j4 # for dual core ... use -j8 for quad core CPU
make install
which puts the binaries for Node.js and npm as well as its modules repository into $NODE_PARENT, a $USER owned dir which then allows you to issue subsequent npm install xxx commands as yourself.
To reach the binaries for node and npm alter your PATH environment variables in your ~/.bashrc:
export PATH=${NODE_PARENT}/bin:${PATH}
export NODE_PATH=${NODE_PARENT}/lib/node_modules
Then to install packages into that directory (global), as opposed to the current directory (local) always pass in the -g flag (global):
npm install -g someModule
NOTE - at no time are you executing anything npm or node related as root / sudo.

Answer 3

Another reason for not installing NPM packages under root is that it will cause you to face file access problem with packages that are using node-gyp (ex: node-sass) because it builds C++ libs and those are not in the local node_modules folder.