nvm VS corepack

Node.js + Nvm - runtime for javascript without a browser

Install Node.js if it hasn't been installed. There are several ways to install Node.js. You may download the installer from the official website, or install it with tools like NVM. After installation, run this command to verify its installation.

Our server also needs Node.js to run our app. We could install the binary directly, but I prefer to use a tool called NVM, which allows us to easily manage Node versions. We can install it with this command:

By setting up your environment in isolation, you can prevent yourself from a lot of issues when experimenting with code. It makes your code behave more predictable due to the defined state of the runtime environment you are working with. This article should provide you with enough information to get started, but obviously, there is a lot more power embedded in NVM, Virtual Environment and RBEnv. So make sure to check their documentation.

I highly recommend setting up nodejs with a version manager, nvm was and still is a popular option, however, I now recommend and have been using fnm, a simpler and faster alternative to manage my nodejs versions.

The purpose of a version manager is to help you navigate or install any tools for development easily. Version Manager can be one tool for each dependency (e.g. NVM, g) or One tool for all dependencies (e.g. asdf, mise).

I usually develop on Windows so I installed NVM for Windows from here, but if you’re on other OS I’m sure you can find a version that supports it, probably this is the answer.

This was a very quick introduction to how I setup NodeJS on my environment using nvm. If you have any questions please refer to the official documentation or contact me via my Social Links.

Source: Can this be used to create/download npm as a standalone executable? #3237.

I'd love to use Bun for my projects, but it's not integrated into Corepack yet (and therefore you cannot pin the bun version w/ checksum in package.json)

https://github.com/nodejs/corepack/issues/295

Recently Node 16 LTS cycle started. One month and a few days before the carry-over, a super controversial package titled `coredeps` [0] was officially declared a core module and has been bundled with all official distributions since.

The NodeJS team refuses to discuss NPM because it's a separate 3rd party. And yet.... this NodeJS Core module comes pre-installed as a global NPM package.

We're just getting started.

This module installs or even reinstalls any supported package manager when you execute a script with a name that would match any that they'd recognise. Opt-in for only a short period, and intending to expand beyond package manager installations.

Amidst all that's been going on, NPM (Nonstop Published Moments) is working on a feature that silently hijacks user commands and installs foreign software. The code found in those compromised packages operated in a similar manner and was labeled a critical severity vulnerability.

The following might actually make you cry.

Of these third party remote distributions it's downloading, the number of checksum, keys, or even build configurations that are being verified is 0.

The game that Microsoft is playing with their recent acquisitions here is quite clear, but there's too much collateral damage.

[0] https://github.com/nodejs/corepack#readme

The new Node.js LTS v16 will be released at the end of October (without a fancy name assigned yet), it'll have Corepack preinstalled in the default configuration since v16.9.0. 👌

Corepack integration