Npm 1.0 released (with global and local installation space)

blog.nodejs.org

45 pointsbauchidgw6 comments

I assume that somebody knows what "npm" is? I have no clue and the linked page doesn't tell me. OTOH it's happy to tell me to feed curl output straight into a root shell, an idea that makes me just a wee bit nervous.

A package manager for nodejs. It is primarily used for development and testing.

You don't use it for production? Do you include modules locally in production?

The NPM authors explicitly draw the line between development and production. Their official stance is that NPM should be a development tool; in production modules should be installed through the native OS package manager. http://blog.nodejs.org/2011/04/04/development-environment/ (bottom) http://blog.nodejs.org/2011/04/06/npm-1-0-link/ ("Caveat: Not For Real Servers")

Neither the command on the page, nor the script it downloads, use sudo (or su for that matter).

Just invoking 'sh' really should not give you a root shell under normal circumstances.

You can try running 'echo "whoami" | sh | grep root' to verify this yourself.

Exactly, and many users install node into ~/local so root privileges are never needed.

Reply on news.ycombinator.com