Ubuntu
nodejs package

NodeJS ships without corepack and suggests npm

Bug #2000788 reported by Oliver Salzburg
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
nodejs (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

This is in reference to corepack: https://github.com/nodejs/corepack

Users who install a modern version of NodeJS expect to have corepack available to interact with the package managers of their projects. The nodejs package does not ship with corepack and instead suggests to install npm, which is only one the package managers people use with NodeJS. corepack is intended to bridge the gap between NodeJS and several package managers.

The documentation at https://nodejs.org/docs/latest-v18.x/api/corepack.html also states that corepack is shipped with NodeJS. The way the package is currently distributed conflicts with the documented and advertised feature set.

Revision history for this message
kapouer (kapouer) wrote : Re: [Bug 2000788] [NEW] NodeJS ships without corepack and suggests npm

Le ven. 30 déc. 2022 à 16:20, Oliver Salzburg <email address hidden>
a écrit :

> Public bug reported:
>
> Title:
> NodeJS ships without corepack and suggests npm
>
> Status in nodejs package in Ubuntu:
> New
>

This is due to a lack of time.
I'll look into adding corepack support into debian nodejs 18.x

Revision history for this message
Oliver Salzburg (oliver-salzburg) wrote :

Okay, awesome. I thought it might have gone unnoticed. Thanks :)

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in nodejs (Ubuntu):
status: New → Confirmed
Revision history for this message
Michael De La Rue (mikedlr) wrote :

I would like to support some priority on this. It's not a security vulnerability as such, but there is a proliferation of different sites which are offering instructions for installing pnpm and yarn on Ubuntu, incuding ones which involve directy piping the output of curl into bash (https://github.com/nodesource/distributions/issues/1476, for example).

The standard instructions for installing yarn (https://yarnpkg.com/getting-started/install) assume that corepack will be available and the fact that it isn't makes people vulnerable to searching google and following one of the more dodgy installation instruction sets.

I believe that this is just a matter of activating a package from sid (https://packages.debian.org/source/sid/node-corepack) or deleting one option during the compile (https://answers.launchpad.net/ubuntu/+source/nodejs/+question/703946) and is unlikely to cause harm because there is no other widely distributed "corepack" binary.

Revision history for this message
kapouer (kapouer) wrote :

Hi,
I'm in favor of removing both "npm, node-corepack" from Suggests,
and promoting "node-corepack" to Recommends.

Revision history for this message
kapouer (kapouer) wrote :

Well, actually it would make more sense to add node-corepack to Depends, so let's do that.
Reading the file:///usr/share/doc/nodejs/api/corepack.html documentation, it's clear that "npm" still plays a special role, so it's legit to let it sit in Suggests.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.