NodeJS unsafe-perm not working on package.json

Question

I am trying to run the npm install command with a pre-installed script on my package.json . I know this is antipattern, but I need to run some scripts as root.

It works great by adding a .npmrc file containing unsafe-perm = true to my root directory. But it does not work by adding the config property to my package.json file:

  { "name": "foo", "version": "1.4.4", "config": { "unsafe-perm":true }, "scripts" : { "preinstall" : "npm install -g bower" } } // It is not working 

According to NPM config docs , it adds this property to my package file. I want to understand why it does not work.

Answer 1

When you add this property, you add it to your script environment with the npm_config_package prefix:

 $ cat package.json { "config": { "unsafe-perm": true } } $ npm run env | grep perm $ npm run env | grep perm npm_package_config_unsafe_perm=true npm_config_unsafe_perm=true $ sudo npm run env | grep perm npm_package_config_unsafe_perm=true npm_config_unsafe_perm= $ 

This is for security reasons, sort of. For an arbitrary package from the npm registry, it would be nice to let you change the npm configuration settings (for example, that if he installed the prefix on /etc and installed a file called passwd )

However, you can still get around this by setting the environment variable in the script line (this will not work on Windows):

 $ cat package.json { "config": { "unsafe-perm": true }, "scripts": { "foo": "npm_config_unsafe_perm=true env" } } $ npm run foo | grep unsafe_perm npm_config_unsafe_perm=true npm_package_config_unsafe_perm=true npm_lifecycle_script=npm_config_unsafe_perm=true env npm_package_scripts_foo=npm_config_unsafe_perm=true env $ sudo npm run foo | grep unsafe_perm npm_config_unsafe_perm=true npm_package_config_unsafe_perm=true npm_lifecycle_script=npm_config_unsafe_perm=true env npm_package_scripts_foo=npm_config_unsafe_perm=true env $ 

This may be a bug in npm , although I would recommend not relying on this behavior. Can you avoid using a different user than root ?

Source: Tested with npm@2.6.1 on OSX. I support volunteer in npm problem tracking, https://github.com/npm/npm/issues .

Answer 2

unsafe waving

Default value: false, if executed as root, true, otherwise Type: Boolean Set to true to suppress UID / GID switching when running package scripts. If false is explicitly specified , then installation as a non-root user will fail .

see https://docs.npmjs.com/misc/config#unsafe-perm