npm-force-install-clobbers-system-symlinks-verify-after
npm install -g <package> --force will silently overwrite existing system symlinks at /usr/bin/ if the package claims a binary with the same name. Installing ast-grep via npm —force overwrote /usr/bin/sg which was the system newgrp symlink, breaking group management. After any npm install --force, immediately run ls -la /usr/bin/<binary> to verify the symlink target hasn’t changed from an expected system binary.