Changing ownership of these files either crashes the system, various local apps, or prevents the system from booting, according to reports from users who installed npm v5.7.0. —the buggy npm update.
Users who installed this update —mostly developers and software engineers— will likely have to reinstall their system from scratch or restore from a previous system image.
The bug was first reported a week ago but was left without an answer from npm developers. Users filed a new bug report after last night’s release, and the npm team has released npm v5.7.1, a version that removes the buggy code.
FreeBSD users have also reported being impacted by the bug. Mac and Windows users didn’t experience any issues. The problem did not affect every Linux user.
Running the npm update commands as root doesn’t result in npm trying to reassign root ownership to all files, so the issue appears to affect only npm update operations prefixed by a sudo command.
Submitted by: Arnfried Walbrecht