{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/10095","labels_url":"https://api.github.com/repos/npm/npm/issues/10095/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/10095/comments","events_url":"https://api.github.com/repos/npm/npm/issues/10095/events","html_url":"https://github.com/npm/npm/issues/10095","id":113049565,"number":10095,"title":"Npm installs binaries of flattened dependencies into node_modules/.bin","user":{"login":"sheerun","id":292365,"avatar_url":"https://avatars.githubusercontent.com/u/292365?v=3","gravatar_id":"","url":"https://api.github.com/users/sheerun","html_url":"https://github.com/sheerun","followers_url":"https://api.github.com/users/sheerun/followers","following_url":"https://api.github.com/users/sheerun/following{/other_user}","gists_url":"https://api.github.com/users/sheerun/gists{/gist_id}","starred_url":"https://api.github.com/users/sheerun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sheerun/subscriptions","organizations_url":"https://api.github.com/users/sheerun/orgs","repos_url":"https://api.github.com/users/sheerun/repos","events_url":"https://api.github.com/users/sheerun/events{/privacy}","received_events_url":"https://api.github.com/users/sheerun/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-23T16:01:30Z","updated_at":"2015-10-23T17:00:14Z","closed_at":"2015-10-23T16:25:27Z","body":"Hey,\r\n\r\nI've noticed that when installing `electron-rebuild` with npm@3, then `npm` binary is added to `node_modules/.bin`.\r\n\r\nHow to reproduce:\r\n\r\n```\r\nexport PATH=./node_modules/.bin:$PATH\r\nnpm --version # 3.3.10\r\nnpm init\r\nnpm install --save electron-rebuild\r\nnpm --version # 2.14.8\r\n```\r\n\r\nI'd expect that `npm` binary is only installed into `electron-rebuild/node_modules/.bin` (and that's the behavior of npm 2.x). I don't want to pollute my binaries by dependencies of my dependencies. The only binary I want when installing `electron-rebuild` is `electron-rebuild`.\r\n\r\nAny comments? :)"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/150633596","html_url":"https://github.com/npm/npm/issues/10095#issuecomment-150633596","issue_url":"https://api.github.com/repos/npm/npm/issues/10095","id":150633596,"user":{"login":"othiym23","id":418097,"avatar_url":"https://avatars.githubusercontent.com/u/418097?v=3","gravatar_id":"","url":"https://api.github.com/users/othiym23","html_url":"https://github.com/othiym23","followers_url":"https://api.github.com/users/othiym23/followers","following_url":"https://api.github.com/users/othiym23/following{/other_user}","gists_url":"https://api.github.com/users/othiym23/gists{/gist_id}","starred_url":"https://api.github.com/users/othiym23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/othiym23/subscriptions","organizations_url":"https://api.github.com/users/othiym23/orgs","repos_url":"https://api.github.com/users/othiym23/repos","events_url":"https://api.github.com/users/othiym23/events{/privacy}","received_events_url":"https://api.github.com/users/othiym23/received_events","type":"User","site_admin":false},"created_at":"2015-10-23T17:00:14Z","updated_at":"2015-10-23T17:00:14Z","body":"It shouldn't be doing that. In the case of a direct install of npm, that will work, because npm bundles literally everything to solve bootstrapping problems, but the first time somebody runs `npm dedupe` on a tree where code is hard-coding assumptions about the shape of the on-disk package tree, things are going to break horribly. Package scripts are the correct way to do this, and they work because the npm run-script code knows enough about the package tree to concatenate the proper things to the path for the script, which is run as a child process."}}