This is the kind of thing I'm more concerned about. npm is configured by default to require sudo/root to install globally. I would rather install as a regular user, like Go packages.
$ npm install socket.io
socket.io@0.9.14 node_modules/socket.io
├── base64id@0.1.0
├── policyfile@0.0.4
├── redis@0.7.3
└── socket.io-client@0.9.11 (xmlhttprequest@1.4.2, uglify-js@1.2.5, active-x-obfuscator@0.0.1, ws@0.4.25)
$ ls
node_modules As of version 0.3, it is recommended to run npm as root.
This allows npm to change the user identifier to the nobody
user prior to running any package build or test commands. [1]
I've worked with node for a couple years. I've used npm hundreds of times, and I can count on one hand the number of times I've used it in combination with sudo (and all but one were a mistake).
~/dev $ ls /usr/local/lib/node_modules/
jsontool npm
Please avoid -g unless installing a CLI tool. You will only end up in version hell if you install globally, which is what node_modules was designed to avoid.