When I follow tutorials that tell me to run "npm install X", should I download the module, scan it for viruses, before doing the "install"?
Linux: Best way to install node & npm
node.js - How to npm install to a specified directory? - Stack Overflow
npm install stuck on idealtree builddeps
How to install npm in terminal?
Does npm install work on Windows?
How to install npm in VS Code?
Videos
I see many tutorials online that just say run "npm install X" nonchalantly. In the past, websites used to add safety remarks such as "only download programs from websites you trust!" and "always keep your virus scanner up to date!".
But telling people to just do "npm install X" without warning them to practice safety seems to reject the safety of yesteryear.
I'm not worried about modules installing malicious code just as crypto miners on the server. I'm only worried about it installing it on my computer!
Should I dow load the tarball file from the nodejs website and install it manually or should I use the package in the debian package repo?
How would one install the tarball version and update nodejs and npm to a newer version manually?
You can use the --prefix option:
mkdir -p ./install/here/node_modules
npm install --prefix ./install/here <package>
The package(s) will then be installed in ./install/here/node_modules. The mkdir is needed since npm might otherwise choose an already existing node_modules directory higher up in the hierarchy. (See npm documentation on folders.)
As of npm version 3.8.6, you can use
npm install --prefix ./install/here <package>
to install in the specified directory. NPM automatically creates node_modules folder even when a node_modules directory already exists in the higher up hierarchy.
You can also have a package.json in the current directory and then install it in the specified directory using --prefix option:
npm install --prefix ./install/here
As of npm 6.0.0, you can use
npm install --prefix ./install/here ./
to install the package.json in current directory to "./install/here" directory. There is one thing that I have noticed on Mac that it creates a symlink to parent folder inside the node_modules directory. But, it still works.
NOTE: NPM honours the path that you've specified through the --prefix option. It resolves as per npm documentation on folders, only when npm install is used without the --prefix option.
Fresh installation
Use the NodeSource PPA. For details look at the installation instructions. First, choose the Node.js version you need and add the sources for it:
v=8 # set to 4, 5, 6, ... as needed
curl -sL https://deb.nodesource.com/setup_$v.x | sudo -E bash -
Then install the Node.js package.
sudo apt-get install -y nodejs
P.S.: curl package must be installed on server for these code lines.
Upgrading
If you have nodejs already installed and want to update, then first remove current instalation and install it again using scripts above.
sudo apt-get purge nodejs npm
Generally speaking, loading arbitrary data from a URL into a root shell session is not a good idea and I wish people would stop peddling it as a solution for everything - "Please just run this script I'm sending you, and also while we're at it - I have a bridge you'd probably be interested in purchasing".
As an alternative, here's the "Ubuntu Way" of doing the same, where you can see how the system is being updated and know what repositories and what keys are added to your system configuration:
curl https://deb.nodesource.com/gpgkey/nodesource.gpg.key | sudo apt-key add -
sudo apt-add-repository "deb https://deb.nodesource.com/node_7.x $(lsb_release -sc) main"
sudo apt-get update
sudo apt-get install nodejs
And here's the "post deprecation of apt-key way" of doing the same thing:
curl https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --dearmor | sudo tee /etc/apt/keyrings/nodesource.gpg
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_7.x $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/nodejs.list
sudo apt update
sudo apt install nodejs
This is for the latest (at time of writing) Nodejs version 7. Other versions can also be gotten with a simple change to the repo URL - consult nodesource.com documentation for details.