{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/10095","labels_url":"https://api.github.com/repos/npm/npm/issues/10095/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/10095/comments","events_url":"https://api.github.com/repos/npm/npm/issues/10095/events","html_url":"https://github.com/npm/npm/issues/10095","id":113049565,"number":10095,"title":"Npm installs binaries of flattened dependencies into node_modules/.bin","user":{"login":"sheerun","id":292365,"avatar_url":"https://avatars.githubusercontent.com/u/292365?v=3","gravatar_id":"","url":"https://api.github.com/users/sheerun","html_url":"https://github.com/sheerun","followers_url":"https://api.github.com/users/sheerun/followers","following_url":"https://api.github.com/users/sheerun/following{/other_user}","gists_url":"https://api.github.com/users/sheerun/gists{/gist_id}","starred_url":"https://api.github.com/users/sheerun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sheerun/subscriptions","organizations_url":"https://api.github.com/users/sheerun/orgs","repos_url":"https://api.github.com/users/sheerun/repos","events_url":"https://api.github.com/users/sheerun/events{/privacy}","received_events_url":"https://api.github.com/users/sheerun/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":14,"created_at":"2015-10-23T16:01:30Z","updated_at":"2015-11-11T01:47:47Z","closed_at":"2015-10-23T16:25:27Z","body":"Hey,\r\n\r\nI've noticed that when installing `electron-rebuild` with npm@3, then `npm` binary is added to `node_modules/.bin`.\r\n\r\nHow to reproduce:\r\n\r\n```\r\nexport PATH=./node_modules/.bin:$PATH\r\nnpm --version # 3.3.10\r\nnpm init\r\nnpm install --save electron-rebuild\r\nnpm --version # 2.14.8\r\n```\r\n\r\nI'd expect that `npm` binary is only installed into `electron-rebuild/node_modules/.bin` (and that's the behavior of npm 2.x). I don't want to pollute my binaries by dependencies of my dependencies. The only binary I want when installing `electron-rebuild` is `electron-rebuild`.\r\n\r\nAny comments? :)"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/155628723","html_url":"https://github.com/npm/npm/issues/10095#issuecomment-155628723","issue_url":"https://api.github.com/repos/npm/npm/issues/10095","id":155628723,"user":{"login":"isaacs","id":9287,"avatar_url":"https://avatars.githubusercontent.com/u/9287?v=3","gravatar_id":"","url":"https://api.github.com/users/isaacs","html_url":"https://github.com/isaacs","followers_url":"https://api.github.com/users/isaacs/followers","following_url":"https://api.github.com/users/isaacs/following{/other_user}","gists_url":"https://api.github.com/users/isaacs/gists{/gist_id}","starred_url":"https://api.github.com/users/isaacs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/isaacs/subscriptions","organizations_url":"https://api.github.com/users/isaacs/orgs","repos_url":"https://api.github.com/users/isaacs/repos","events_url":"https://api.github.com/users/isaacs/events{/privacy}","received_events_url":"https://api.github.com/users/isaacs/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T01:47:47Z","updated_at":"2015-11-11T01:47:47Z","body":"I'm not seeing a \"regression\", per se.  You'd have the same problem if you did `npm install npm` in your project with that setup, or ran `npm dedupe`.\r\n\r\nIt seems like you're requesting that we stop linking metadep bins into the `node_modules/.bin` folder.  That's not gonna work.  The purpose of `node_modules/.bin` is to have a predictable location for dep bins that are used in npm run scripts.  Either we link bins into that folder (so that they can be used by scripts) or we don't link bins there (in which case it's pointless to have it in your own PATH anyway, and also, we violate the contract we've established, which *would* be a regression).\r\n\r\nA slightly different request could be that we only link the top-level deps into `node_modules/.bin` and link metadeps into their dependents' `node_modules/.bin` folder.  That is not completely unreasonable, but definitely a deviation from the current design, and it's extra work.  The info is there in the local metadata, so it it's not impossible in theory.  Extra typing and tests and so on.\r\n\r\nPersonally, I don't recommend having `node_modules/.bin` in your PATH environment variable for exactly this reason.  Install stuff globally if you wanna use the global one, or via an npm script if you want the local one.  But that's just me.  You set up your computer however you like :)\r\n\r\nIf @othiym23 and team think this is a reasonable feature request, I'd recommend stating the specific change more clearly as a new issue, rather than re-opening this one, since it's got a lot of distracting back and forth."}}