Node.js and npm

Node.js runs JavaScript outside the browser; npm is its bundled package manager and pnpm is a faster, disk-efficient alternative. Manage Node versions with nvm or fnm rather than a system package so each project can pin its own.

Documentation: npm docs, pnpm docs, fnm, nvm

Version Managers #

Pin a project version by putting 22 (or lts/*) in .nvmrc; fnm reads .nvmrc and .node-version. The engines field in package.json documents the supported range. corepack enable activates pnpm and yarn at the version a project declares in packageManager (Corepack ships with most Node releases; newer ones may need npm install -g corepack first).

npm Commands #

pnpm Commands #

pnpm uses a shared content-addressable store and hard links, which saves disk space and keeps node_modules strict about undeclared dependencies.

npx #

Only run packages you trust: npx executes code straight from the registry.

package.json #

{
  "name": "my-app",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "engines": { "node": ">=22" },
  "packageManager": "pnpm@9.15.0",
  "scripts": {
    "dev": "vite",
    "build": "vite build",
    "test": "vitest run",
    "lint": "eslint .",
    "prebuild": "npm run lint",
    "postinstall": "echo done"
  },
  "dependencies": {},
  "devDependencies": {}
}

Version ranges: ^1.2.3 allows 1.x.x (below 2.0.0), ~1.2.3 allows 1.2.x, 1.2.3 is exact.

Lockfiles #

Commit the lockfile for applications and use one package manager per project. Delete node_modules and run the CI install command to reproduce a clean build.

Audit and Security #

Troubleshooting #

Never commit an .npmrc that holds an auth token; use environment variables (//registry.npmjs.org/:_authToken=${NPM_TOKEN}).

Not Verified #

Commands were written from the official documentation and not executed. The nvm install script version shown may be out of date.