[BUG] npm installs package with wrong user/group ownership

[eocantu]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When installing a certain package as root within a folder owned by root, the ownership of those files are not as expected.

Logs:

root@3a9aa418b816:/tmp/test-install# npm -v
9.4.2
root@3a9aa418b816:/tmp/test-install# npm init -y
Wrote to /tmp/test-install/package.json:

{
  "name": "test-install",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC"
}


root@3a9aa418b816:/tmp/test-install# npm install [email protected]

added 2 packages, and audited 3 packages in 287ms

found 0 vulnerabilities
root@3a9aa418b816:/tmp/test-install# ls -al node_modules/tmp/
total 32
drwxr-xr-x 3 root       root       4096 Feb 15 14:57 .
drwxr-xr-x 4 root       root       4096 Feb 15 14:57 ..
-rw-r--r-- 1 2119470584 2042662593 1082 Feb 15 14:57 LICENSE
-rw-r--r-- 1 2119470584 2042662593 9293 Feb 15 14:57 README.md
drwxr-xr-x 2 root       root       4096 Feb 15 14:57 lib
-rw-r--r-- 1 2119470584 2042662593  751 Feb 15 14:57 package.json

In the above output, some files aren't owned by root.

Expected Behavior

The installed files should be owned by root.

Steps To Reproduce

docker run --rm -i -t --entrypoint=bash node:18
mkdir -p /tmp/test-install
cd /tmp/test-install
npm init -y
npm install [email protected]
ls -al node_modules/tmp/

Files have a strange ownership.

# ls -al node_modules/tmp/
total 32
drwxr-xr-x 3 root       root       4096 Feb 15 14:53 .
drwxr-xr-x 4 root       root       4096 Feb 15 14:53 ..
-rw-r--r-- 1 2119470584 2042662593 1082 Feb 15 14:53 LICENSE
-rw-r--r-- 1 2119470584 2042662593 9293 Feb 15 14:53 README.md
drwxr-xr-x 2 root       root       4096 Feb 15 14:53 lib
-rw-r--r-- 1 2119470584 2042662593  751 Feb 15 14:53 package.json

Environment

• npm: 9.4.2
• Node.js: 18.14.0
• OS Name: Debian 11 (bullseye)
• System Model Name: Docker container
• npm config:

; node bin location = /usr/local/bin/node
; node version = v18.14.0
; npm local prefix = /tmp/test-install
; npm version = 9.4.2
; cwd = /tmp/test-install
; HOME = /root
; Run `npm config ls -l` to show all defaults.

# cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"