yarn global upgrade installing dependencies in the global folder

[DonNicoJs]

What is the current behavior? yarn global upgrade is installing dependencies of installed packages in the global folder.

If the current behavior is a bug, please provide the steps to reproduce.

yarn global add resin-cli
cat $(yarn global bin)/sudo -> No such file or directory

yarn global upgrade
cat $(yarn global bin)/sudo -> *js code output*

yarn global remove resin-cli
cat $(yarn global bin)/sudo -> No such file or directory

yarn global add resin-cli
cat $(yarn global bin)/sudo -> No such file or directory

What is the expected behavior? yarn global upgrade should not install dependencies or optionalDependencies in the global folder

Please mention your node.js, yarn and operating system version.

node -v -> v8.8.1
yarn --version -> 1.5.1
sw_vers -> ProductName: Mac OS X - ProductVersion: 10.13.1  - BuildVersion: 17B1003

additional detaisl yarn global list before the execution of yarn global upgrade:

yarn global v1.5.1
info "@vue/cli@3.0.0-beta.2" has binaries:
   - vue
info "ava@0.19.1" has binaries:
   - ava
info "browser-sync@2.23.6" has binaries:
   - browser-sync
info "docsify-cli@4.2.0" has binaries:
   - docsify
info "grunt-cli@1.2.0" has binaries:
   - grunt
info "nyc@10.3.2" has binaries:
   - nyc
info "poi@9.6.13" has binaries:
   - poi
info "resin-cli@6.13.4" has binaries:
   - resin
info "serve@6.5.1" has binaries:
   - serve
info "webpack-bundle-analyzer@2.11.1" has binaries:
   - webpack-bundle-analyzer

yarn global list after the execution of yarn global upgrade

info "@vue/cli@3.0.0-beta.2" has binaries:
   - vue
info "ava@0.19.1" has binaries:
   - ava
info "browser-sync@2.23.6" has binaries:
   - browser-sync
info "docsify-cli@4.2.0" has binaries:
   - docsify
info "grunt-cli@1.2.0" has binaries:
   - grunt
info "nyc@10.3.2" has binaries:
   - nyc
info "poi@9.6.13" has binaries:
   - poi
info "resin-cli@6.13.4" has binaries:
   - resin
info "serve@6.5.1" has binaries:
   - serve
info "webpack-bundle-analyzer@2.11.1" has binaries:
   - webpack-bundle-analyzer

yarn_global_upgrade_output.txt

[kayahr]

I think I just encountered the same problem. I was wondering why the touch command on my linux system suddenly behaves strange and found out that it was replaced by a Node.js application which was installed in Yarn's global module folder (Yeah, I know my PATH variable is/was in wrong order...).

I can reproduce it like this:

• Run yarn global add typings.
• Check the user bin folder, only one binary link was created for the typings program. So everything is fine.
• Run yarn global upgrade.
• Check the user bin folder again. Now there is also is-ci, loose-envify, rc, rimraf, semver, touch, tsc, tsserver and which. This should not be the case.

[equinox]

Any update on this?

[kallookoo]

Same problem