No. When a global npm install fails with an EACCES permissions error, npm's documentation recommends reinstalling npm through a node version manager, or changing npm's default directory to a folder you own. Running the install as root works, but it hands a package's install scripts full control of your machine.
Why the error happens
By default npm's global prefix is the folder where Node is installed, commonly /usr/local on Unix systems. Your normal user cannot write there. The error is the system doing its job: it is telling you that a program running as you should not be changing shared system folders.
The tempting fix is to put sudo in front of the command. It works because root can write anywhere. It also means the package, and any install scripts it or its dependencies run, execute as root. If you are not sure what a package's scripts do, that is the wrong privilege to hand over. Our post on which npm lifecycle scripts run at install lists what can execute.
The two fixes npm documents
The npm page on resolving EACCES errors gives two options.
| Option | What it does | Notes |
|---|---|---|
| Reinstall with a node version manager | Node and global packages live under your home directory | Marked as the recommended way. You do not need to remove your current Node first |
| Change npm's default directory | Point the prefix at a folder you own, then add its bin folder to PATH | The page notes this section does not apply to Microsoft Windows |
Both put global packages somewhere your user owns, which removes the need for elevated rights.
Steps for the user-owned directory route
- Create a directory in your home folder for global packages.
- Tell npm to use it as the prefix.
- Add that directory's bin folder to your PATH in your shell profile file.
- Reload the profile, then install a package globally without sudo as a test.
Check each step against the current npm page rather than copying commands from memory, since shell profile names vary by shell. The documentation notes, for example, that zsh users may need an extra line in a different profile file.
What you give up and what you gain
A user-owned prefix means a compromised global package can touch your files, but not system folders. That is still serious, because your home directory holds SSH keys and tokens. It is, however, a smaller blast radius than root.
A related habit: check where a tool came from before installing it at all. The post on checking an npm package before you install it gives a short routine.
When root is genuinely needed
Some system-wide tools are meant to be installed for every user on a shared server. That is a deliberate administrative action, ideally done from a pinned, reviewed script, not an ad hoc command typed to silence an error.
Quick check
Does sudo make a global install more secure?
No. It only bypasses the permission error and runs install scripts with root rights.
Which fix does npm call recommended?
Reinstalling npm with a node version manager, per the npm documentation.
Does the change-directory fix work on Windows?
The npm page states that section does not apply to Microsoft Windows.
Sources
Last reviewed: 19 October 2026.
