[BUG] npx drops sudo uid/gid before executing command

[mikol]

What / Why

Using sudo to execute npx (which in turn executes the command we really care about) results in an EPERM error with node v14.4.0 (npm v7.5.5). The same invocation works as expected with v12.20.2 (npm v6.14.11) or when invoked without npx.

When

• Running an npm script that uses npx to execute a command

Where

• macOS Catalina 10.15.7 (19H524)
• node v14.4.0 (npm v7.5.5)

How

Current Behavior

• process.getuid() returns an unprivileged user ID (e.g., 501), not the root user ID (i.e., 0)

Steps to Reproduce

• Configure package.json as follows:

{
  "name": "sudo-npx",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1",
    "with-npx": "sudo npx -c 'node -e \"console.log(process.getuid())\"'",
    "without-npx": "sudo sh -c 'node -e \"console.log(process.getuid())\"'"
  },
  "author": "",
  "license": "ISC"
}

• Then run:

. nvm use default                                                                   
Now using node v14.4.0 (npm v7.5.5)

. npm run with-npx   

> sudo-npx@1.0.0 with-npx
> sudo npx -c 'node -e "console.log(process.getuid())"'

501

• Compare the result to:

. nvm use default                                                                   
Now using node v14.4.0 (npm v7.5.5)

. run without-npx

> styra-ui@0.0.0 /Users/mikol/src/com/styra/ui
> sudo sh -c 'node -e "console.log(process.getuid())"'

0

• Or compare the result to:

. nvm use lts/erbium                                                                
Now using node v12.20.2 (npm v6.14.11)

. run with-npx      

> styra-ui@0.0.0 /Users/mikol/src/com/styra/ui
> sudo npx -c 'node -e "console.log(process.getuid())"'

0

Expected Behavior

• process.getuid() should return 0 when a script is invoked with sudo npx -c

Who

• n/a

References

• n/a