[BUG] `npm install -g npm` may break npm installation

[dimaqq]

I got this notification (on git commit, I'm not sure how exactly, maybe pre-commit hook in package.json or some shell integration)

 ╭────────────────────────────────────────────────────────────────╮
 │ │
 │ New patch version of npm available! 6.13.1 → 6.13.2 │
 │ Changelog: https://github.com/npm/cli/releases/tag/v6.13.2 │
 │ Run npm install -g npm to update! │
 │ │
 ╰────────────────────────────────────────────────────────────────╯

So I tried to upgrade npm globally...

First run:

… ~/someproject> npm install -g npm
npm WARN remove Error: EACCES: permission denied, unlink '/usr/local/lib/node_modules/.npm.MODULES/agentkeepalive/README.md'
npm WARN remove [Error: EACCES: permission denied, unlink '/usr/local/lib/node_modules/.npm.MODULES/agentkeepalive/README.md'] {
npm WARN remove stack: "Error: EACCES: permission denied, unlink '/usr/local/lib/node_modules/.npm.MODULES/agentkeepalive/README.md'",
npm WARN remove errno: -13,
npm WARN remove code: 'EACCES',
npm WARN remove syscall: 'unlink',
npm WARN remove path: '/usr/local/lib/node_modules/.npm.MODULES/agentkeepalive/README.md'
npm WARN remove }
/usr/local/bin/npm -> /usr/local/lib/node_modules/npm/bin/npm-cli.js
/usr/local/bin/npx -> /usr/local/lib/node_modules/npm/bin/npx-cli.js
+ npm@6.13.2
updated 1 package in 5.564s

Partially failed, partially succeeded.

Let's test it:

… ~/someproject> npm install -g npm
internal/modules/cjs/loader.js:783
 throw err;
 ^

Error: Cannot find module 'semver'
Require stack:
- /usr/local/lib/node_modules/npm/lib/utils/unsupported.js
- /usr/local/lib/node_modules/npm/bin/npm-cli.js
 at Function.Module._resolveFilename (internal/modules/cjs/loader.js:780:15)
 at Function.Module._load (internal/modules/cjs/loader.js:685:27)
 at Module.require (internal/modules/cjs/loader.js:838:19)
 at require (internal/modules/cjs/helpers.js:74:18)
 at Object.<anonymous> (/usr/local/lib/node_modules/npm/lib/utils/unsupported.js:2:14)
 at Module._compile (internal/modules/cjs/loader.js:945:30)
 at Object.Module._extensions..js (internal/modules/cjs/loader.js:962:10)
 at Module.load (internal/modules/cjs/loader.js:798:32)
 at Function.Module._load (internal/modules/cjs/loader.js:711:12)
 at Module.require (internal/modules/cjs/loader.js:838:19) {
 code: 'MODULE_NOT_FOUND',
 requireStack: [
 '/usr/local/lib/node_modules/npm/lib/utils/unsupported.js',
 '/usr/local/lib/node_modules/npm/bin/npm-cli.js'
 ]
}

Uh-oh, it's broken now :(

Surely it's an artefact of my installation being somehow half-assed in the first place, but this is a bummer...

[DanielRuf]

This is because you probably installed npm with sudo in the past. You have to manually fix the owner and then upgrade npm.

[awhitford]

I installed npm along with Node using the MacOS Package Installer. It appears that it installed npm as root:

$ ll /usr/local/bin/npm 
lrwxr-xr-x 1 root wheel 38 Jul 15 14:09 /usr/local/bin/npm -> ../lib/node_modules/npm/bin/npm-cli.js

$ ll /usr/local/lib/node_modules/
drwxr-xr-x 24 root wheel 768 Jun 2 10:31 npm

$ ll /usr/local/lib/node_modules/npm/bin/npm-cli.js 
-rwxr-xr-x 1 root wheel 4615 Apr 27 05:25 /usr/local/lib/node_modules/npm/bin/npm-cli.js

npm (v6.14.4) works fine, but if I try to update (to v6.14.6 using npm install -g npm) it...

1. WITHOUT sudo, the update fails:

npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/nopt
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/mkdirp
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/graceful-fs
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/node_modules/safe-buffer
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/spdx-license-ids
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules
npm WARN checkPermissions Missing write access to /usr/local/lib/node_modules/npm/node_modules/npm-registry-fetch/node_modules
npm ERR! code EACCES
npm ERR! syscall access
npm ERR! path /usr/local/lib/node_modules/npm/node_modules/nopt
npm ERR! errno -13
npm ERR! Error: EACCES: permission denied, access '/usr/local/lib/node_modules/npm/node_modules/nopt'
npm ERR! { [Error: EACCES: permission denied, access '/usr/local/lib/node_modules/npm/node_modules/nopt']
npm ERR! stack:
npm ERR! 'Error: EACCES: permission denied, access \'/usr/local/lib/node_modules/npm/node_modules/nopt\'',
npm ERR! errno: -13,
npm ERR! code: 'EACCES',
npm ERR! syscall: 'access',
npm ERR! path: '/usr/local/lib/node_modules/npm/node_modules/nopt' }
npm ERR! 
npm ERR! The operation was rejected by your operating system.
npm ERR! It is likely you do not have the permissions to access this file as the current user
npm ERR! 
npm ERR! If you believe this might be a permissions issue, please double-check the
npm ERR! permissions of the file and its containing directories, or try running
npm ERR! the command again as root/Administrator.

npm ERR! A complete log of this run can be found in:
npm ERR! /Users/anthony/.npm/_logs/2020-07-15T21_06_35_723Z-debug.log

2. WITH sudo, the update "succeeds," but then npm is broken:

internal/modules/cjs/loader.js:638
 throw err;
 ^

Error: Cannot find module 'semver'
 at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
 at Function.Module._load (internal/modules/cjs/loader.js:562:25)
 at Module.require (internal/modules/cjs/loader.js:692:17)
 at require (internal/modules/cjs/helpers.js:25:18)
 at Object.<anonymous> (/usr/local/lib/node_modules/npm/lib/utils/unsupported.js:2:14)
 at Module._compile (internal/modules/cjs/loader.js:778:30)
 at Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
 at Module.load (internal/modules/cjs/loader.js:653:32)
 at tryModuleLoad (internal/modules/cjs/loader.js:593:12)
 at Function.Module._load (internal/modules/cjs/loader.js:585:3)

❓ How can this be resolved?

[ljharb]

Once npm is broken, you have to reinstall node.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.