npm / npm/cli

[BUG] `npm update -g ds` removes all global packages and npm itself

Open
#7,731 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug platform:windows Priority 2
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

Title. Basically self-destructs and purges all global packages and you can't even run npm after.
As I have tested, it works with any package that is not installed, even non-existent ones.

npm update -g [non-installed package]

To fix it, you need to re-install whole Node again with nvm.

Expected Behavior

Don't self-destruct and delete all global packages, when you specify package that is not installed.

Steps To Reproduce
  1. run npm update -g ds
  2. get the result
removed 203 packages in 641ms
The batch file cannot be found.
  1. try to run npm again npm -v
'npm' is not recognized as an internal or external command,
operable program or batch file.
  1. become aware of your unimportance to the universe
Environment
  • npm: probably was 10.8.2, but I cannot check it because npm itself doesn't exist anymore.
  • Node.js: 22.6.0 (64-bit) via nvm
  • OS Name: Windows 10
  • npm config: cannot give you, as stated above.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce npm update -g ds on Windows 10 with Node.js 22.6.0 installed through nvm, then verify whether global packages and npm are removed and npm -v fails. Trace the global-update entry point responsible for handling a package that is not installed. Done means the command no longer removes unrelated global packages or npm, and the reported reproduction is covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.