{"action":"created","issue":{"url":"https://api.github.com/repos/npm/npm/issues/9078","labels_url":"https://api.github.com/repos/npm/npm/issues/9078/labels{/name}","comments_url":"https://api.github.com/repos/npm/npm/issues/9078/comments","events_url":"https://api.github.com/repos/npm/npm/issues/9078/events","html_url":"https://github.com/npm/npm/issues/9078","id":97528847,"number":9078,"title":"global library installations on windows are completely insecure","user":{"login":"clshortfuse","id":9271155,"avatar_url":"https://avatars.githubusercontent.com/u/9271155?v=3","gravatar_id":"","url":"https://api.github.com/users/clshortfuse","html_url":"https://github.com/clshortfuse","followers_url":"https://api.github.com/users/clshortfuse/followers","following_url":"https://api.github.com/users/clshortfuse/following{/other_user}","gists_url":"https://api.github.com/users/clshortfuse/gists{/gist_id}","starred_url":"https://api.github.com/users/clshortfuse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clshortfuse/subscriptions","organizations_url":"https://api.github.com/users/clshortfuse/orgs","repos_url":"https://api.github.com/users/clshortfuse/repos","events_url":"https://api.github.com/users/clshortfuse/events{/privacy}","received_events_url":"https://api.github.com/users/clshortfuse/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/npm/npm/labels/documentation","name":"documentation","color":"d105f0"},{"url":"https://api.github.com/repos/npm/npm/labels/feature-request","name":"feature-request","color":"ACE1AF"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-27T18:45:58Z","updated_at":"2015-07-29T05:36:17Z","closed_at":"2015-07-29T05:36:17Z","body":"On Windows systems, global modules are installed into %APPDATA%\r\n\r\nThe problem is, any application can write to %APPDATA%\r\n\r\nCompare this with a linux environment where npm packages are installed to /usr/local/bin but requires elevated permissions to write to it. \r\n\r\nAny app can write over AppData bower/grunt-cli/etc installations and steal/inject data without the need for administrative rights. \r\n\r\nI can't think of any other secure place rather than %programfiles% since you need administrative rights to write to it.\r\n\r\nCurrently I'm using:\r\n\r\n    npm config set prefix \"%programfiles%\\npm\"\r\n    npm config set cache \"%programfiles%\\npm\\cache\"\r\n\r\nas a workaround (and then changing the environment paths)"},"comment":{"url":"https://api.github.com/repos/npm/npm/issues/comments/125848953","html_url":"https://github.com/npm/npm/issues/9078#issuecomment-125848953","issue_url":"https://api.github.com/repos/npm/npm/issues/9078","id":125848953,"user":{"login":"othiym23","id":418097,"avatar_url":"https://avatars.githubusercontent.com/u/418097?v=3","gravatar_id":"","url":"https://api.github.com/users/othiym23","html_url":"https://github.com/othiym23","followers_url":"https://api.github.com/users/othiym23/followers","following_url":"https://api.github.com/users/othiym23/following{/other_user}","gists_url":"https://api.github.com/users/othiym23/gists{/gist_id}","starred_url":"https://api.github.com/users/othiym23/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/othiym23/subscriptions","organizations_url":"https://api.github.com/users/othiym23/orgs","repos_url":"https://api.github.com/users/othiym23/repos","events_url":"https://api.github.com/users/othiym23/events{/privacy}","received_events_url":"https://api.github.com/users/othiym23/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T05:36:17Z","updated_at":"2015-07-29T05:36:17Z","body":"Thanks for putting this together! I'm a little confused as to what it is you're asking for here – are you suggesting that the default cache and global prefix be changed on Windows? If so, you should probably take a look at #4564, where it's pretty clear that there's not a consensus about where npm should install things. What consensus there is in that issue is that there are probably more situations where writing to the roaming profile folder is a problem than writing to the local, but I don't see a lot of energy in favor of `%programfiles%` there.\r\n\r\nI wouldn't describe your current solution as a workaround, since it gives you the level of control you feel is appropriate. In general, it's not really npm's place to have an opinion about users' operational environments. The current defaults were chosen in consultation with folks at Microsoft, and make sense to me for reasons I'll get into below. I personally don't think it makes much sense to require Administrator privileges to write to the cache, especially because practically no Unix or OS X users have their caches set up that way.\r\n\r\nMy own work laptop is set up so that `/usr/local` is owned and writable by my account (which is typical for Homebrew users like me). This makes a lot of sense for developer environments, which I think probably accounts for the vast majority of npm users on Windows. The Windows installer treats the bundled npm installation as part of the Node install, which is why it gets written into the same directory as Node. I can tell you that the requirement that users run with Administrator privileges to upgrade the bundled version of npm is confusing to a very large number of users, and is an ongoing support cost for the CLI team, to the point that it's [a frequently referred-to point in our Troubleshooting FAQ](https://github.com/npm/npm/wiki/Troubleshooting#upgrading-on-windows).\r\n\r\nEither way, we probably are going to change at least the global prefix at some point in the medium term, but since the discussion around that has mostly happened on #4564, I'm closing this issue as a duplicate of that one. We haven't made any decisions yet, so if after reading the discussion there, you think there's a case to be made for `%programfiles%`, feel free to weigh in!"}}