>4.3 no longer installs correctly with `npm install -g` (sqlite3)

• Node version: 16.14
• Operating system: Ubuntu 20.04 LTS
• The Lounge version: git 7cf95d3cbde8cf41957df93c8d4a3547bebd4cae

---

To reproduce this take an Ubuntu 20.04 system and perform the following:

wget 'https://nodejs.org/dist/v16.14.0/node-v16.14.0-linux-x64.tar.xz'
tar -xvf node-v16.14.0-linux-x64.tar.xz --strip-components=1 -C /usr/local
git clone https://github.com/thelounge/thelounge.git
cd thelounge
# (build steps are missing here, these don't matter for the demonstration)
npm pack .
cd ..
npm install -g --prefix $PWD/test ./thelounge/thelounge-4.3.0.tgz

Expected behaviour: The sqlite module is installed at test/lib/node_modules/thelounge/node_modules/sqlite3.

Actual behaviour: There is a broken symlink at test/lib/node_modules/sqlite3. lrwxrwxrwx 1 root root 42 Mar 2 18:12 test/lib/node_modules/sqlite3 -> ../../../.npm/_cacache/tmp/git-cloneYdcsZu

Why does this matter? The Debian and Arch package both use npm install -g.

This is a regression since commit c7e504eeab4f09ef673ce896417638632dfd1ed0.

[brunnre8]

Not sure why or how npm manages to fuck it up, but I must say I’ve run out of patience. If anyone has any ideas as to why npm does the symlink, I’d be very interested to hear them.

For packages I maintain, we’ll simply switch to yarn for the installation.

yarn install --frozen-lockfile
export NODE_ENV_PRODUCTION
yarn build
yarn pack --filename thelounge.tar.gz
yarn global add --frozen-lockfile --prefix /usr --global-folder /opt/thelounge file:"$(pwd)/thelounge.tar.gz"

Should do.

[brunnre8]

Considering all the recent attacks from misguided developers on npm that willy nilly modify their popular packages to rm -rf /* or similar things, I suggest people only use yarn to install TL and hence (hopefully) use our lockfile.

The version lookup without that is clearly broken, recent examples:

• https://github.com/advisories/GHSA-97m3-w2cp-4xx6
• https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

I’m closing this, however if someone really wants to make npm work and the change on our side is sensible I’d be happy to take it.