6 ms·

You generally shouldn’t ever use sudo with either Homebrew or NPM. Homebrew is specifically designed to be used without elevated privileges. This has the downs

You generally shouldn’t ever use sudo with either Homebrew or NPM. Homebrew is specifically designed to be used without elevated privileges. This has the downside that packages are owned by the user which first ran the install (which might lead to those packages running with elevated privileges after a sudo install as well? I don’t know, and I’m not eager to find out). NPM packages are typically either project local (and these definitely shouldn’t be installed with sudo), or “global” (which should be global in the sense of being installed on the user’s PATH, and thus shouldn’t require sudo for any normal setup either). You’re right to be cautious about the security implications of this.

pxc 3y ago
> This has the downside that packages are owned by the user which first ran the install This is a bit of a security problem if Homebrew's .../bin is on your sudoers secure_path, because now your normal user can overwrite something that might be invoked via a simple `sudo whatever`, which doesn't specify the full path to whatever > which might lead to those packages running with elevated privileges after a sudo install as well? I don’t know, and I’m not eager to find out No, definitely not by any normal mechanism. Maybe there are some exception, like packages that set up LaunchAgents or LaunchDaemons, or which run the install scripts of .pkg installers which ask for elevated privileges. But those can set up programs that run with elevated privileges anyway.
comprev 3y ago
Brew will prompt for elevated privileged when necessary, or at least formulae should conform to that design