Can I copy the "node_modules" directory to other machines without having to run "npm install" each time?

Question

Two Linux machines. Both are CentOS x64, but different versions.

Say I run npm install on machine #1, copy my entire application including the node_modules directory to machine #2 and run it there. Is that supported? Or, it is always advised to run npm install on each machine?

I was successful doing npm install on a Centos 6 x64 machine, copying the app including node_modules to a Centos 7 x64 machine. The application seemed to run fine. Even though it worked for me, is this generally safe to do so?

Answer 1

Is it always advised to run npm install on each machine?

Probably so, because that is one of the purposes of a package manager, to maintain your packages easily across machines.

That being said, nothing is stopping you from directly copying node_modules somewhere else. In fact, this might be necessary in the case that you want to add your project to a machine that is offline. Technically, you could even copy them to a machine that doesn't even have npm. From node's perspective, if the node_modules is there, it will find its dependencies.

Is this generally safe to do so?

Well, the security issue isn't really in copying node_modules versus re-installing them. The more important issue is to understand the security implications of all of your dependencies and, when confirming they are safe, to lock them to specific versions in package.json. That way you'll make sure that every npm install installs the same code* (assuming npm itself isn't doing something funky but that's always a trust problem)

*Even if you fix versions in your package.json file, there's still possible breaks that can happen. For example, a dependency of a project you depend on with a specific version itself depends on another package with a version range. This means that, technically, authors of those other packages can add code that no longer supports your version of node or introduce a bug or fix a bug that you actually depend on etc.

If you know your dependencies are safe and you 100% want to leave them that way, copy the node_modules folder and disconnect from the internet :)

Here's a good related read on general state of software dependencies today and another one with more NPM details.