Node npm

The Node.js package manager.

mpm drives npm in global mode: every call forces --global so packages land in the shared prefix instead of the current working directory. Per-scope targeting and multi-binary discovery (several node versions through nvm) are tracked in #1725. Command equivalences with the sibling JS managers are listed at https://github.com/antfu-collective/ni?tab=readme-ov-file#ni.

Queries parse npm’s --json output. Mutating operations are marked privileged so --sudo can escalate writes into a root-owned global prefix, though escalation stays dormant unless requested.

Note

npm enforces a supply-chain cooldown through its min-release-age resolver option, refusing to resolve any release younger than the configured age. The version floor exists for it: min-release-age first shipped in 11.10.0, and older releases silently ignore the setting.

Caution

A fatal npm error (usually a local node version out of sync) is reported both on <stderr> and as a JSON blob on <stdout>. The run_cli override blanks that JSON so the failure surfaces once, through <stderr>, rather than being parsed as a package listing.

Platforms

  • 🅱️ BSD

  • 🐧 Linux

  • 🍎 macOS

  • ⨂ Unix

  • 🪟 Windows

Operations

Operation

Supported

Notes

installed

✓

outdated

✓

search

✓

exact search backfilled by mpm

install

✓

upgrade

✓

upgrade_all

✓

remove

✓

sync

cleanup

✓

Ecosystem

Usage

$ mpm --npm installed
$ mpm --npm search "query"
$ mpm --npm upgrade --all
$ mpm install pkg:npm/hello
$ mpm --dry-run --npm upgrade --all

Every example above accepts --dry-run, which simulates the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Deselect the manager for a single run with --no-npm, disable it from your configuration, or tune its invocation attributes with per-manager overrides.

Command line

  • CLI names, in lookup order: npm

  • Arguments forced before each call: --global --no-progress --no-update-notifier --no-fund --no-audit

The version is extracted from the output of npm --version with:

r"(?P<version>\S+)"

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

mpm natively enforces its release-age cooldown on Node npm, injecting the npm_config_min-release-age environment variable on every call.

  • Status: ✅ Enforced (npm ≥ 11.10)

  • Mechanism: min-release-age env npm_config_min-release-age (integer days)

  • Reference: npm docs

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Node npm well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ npm --global --no-progress --no-update-notifier --no-fund --no-audit                 --json --depth 0 list
{
  "name": "lib",
  "dependencies": {
    "@eslint/json": {
      "version": "0.9.0",
      "overridden": false
    },
    "@mermaid-js/mermaid-cli": {
      "version": "10.8.0",
      "overridden": false
    },
    "corepack": {
      "version": "0.30.0",
      "overridden": false
    },
    "google-closure-compiler": {
      "version": "20240317.0.0",
      "overridden": false
    },
    "npm": {
      "version": "10.9.2",
      "overridden": false
    },
    "raven": {
      "version": "2.6.4",
      "overridden": false
    },
    "wrangler": {
      "version": "3.51.2",
      "overridden": false
    }
  }
}

$ npm --global --no-progress --no-update-notifier --no-fund --no-audit                 --json outdated
{
  "my-linked-package": {
    "current": "0.0.0-development",
    "wanted": "linked",
    "latest": "linked",
    "location": "/Users/kev/dev/my-linked-package"
  },
  "npm": {
    "current": "3.10.3",
    "wanted": "3.10.5",
    "latest": "3.10.5",
    "location": "/opt/homebrew/lib/node_modules/npm"
  }
}