npm "EACCES: permission denied": fix it without sudo

1. Global installs: don’t use sudo

The tempting fix is sudo npm install -g. It works, and it’s how the second case below starts. It also runs the install scripts of every package and its dependencies as root. Instead, make global installs live somewhere you own.

A version manager is the best fix. nvm, fnm or Volta install Node.js in your home directory, so global packages need no special rights, and you can switch versions per project:

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.41.0/install.sh | bash
# open a new terminal
nvm install --lts
npm install -g typescript

Or change npm’s global folder, if you keep the system’s Node.js:

mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
npm install -g typescript

On macOS the default shell is zsh, so use ~/.zshrc. And many tools don’t need a global install at all: npx typescript --version runs one without installing it for good.

2. Files owned by root in your project or cache

Someone ran sudo npm install once, and now root owns some files, so your normal user can’t change them. See who owns what:

ls -ld node_modules ~/.npm
find node_modules ~/.npm ! -user "$USER" | head

Give them back:

sudo chown -R "$(id -u):$(id -g)" node_modules ~/.npm

With package-lock.json in place, you can also delete and reinstall, as your own user this time:

sudo rm -rf node_modules
npm ci

3. In Docker

The classic Dockerfile mistake: switching to the node user before it has a folder it can write to:

FROM node:24-alpine
WORKDIR /app              # created as root
USER node
COPY package*.json ./
RUN npm ci                # EACCES: mkdir '/app/node_modules'

Install as root, and switch at the end. Your code stays read-only for the app, which is what you want:

FROM node:24-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
USER node
CMD ["node", "server.js"]

The Dockerfile Generator writes it this way. If the app itself needs to write somewhere, create that one folder and chown it to node. A bind mount (-v .:/app) keeps the host’s owners, so compare your host’s user ID with the container’s: id -u on the host, and docker compose exec app id -u.