HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
npm
cli
JavaScript2018–2026
npm / cli

cli

the package manager for JavaScript

Command LineWeb DevelopmentDeveloper Tools
Explore on GitHubRead Hacker News discussions
55Distinct people
59Mentions
0Explicit recommenders
10.3KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

the package manager for JavaScript

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year59 dated mentions

Observed mentions: 2018-12-03 07:29:37 UTC to 2026-10-12 14:10:06 UTC.

0369122018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20182019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 4 mentions; 3 submissions, 1 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 11 mentions; 2 submissions, 9 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 9 mentions; 2 submissions, 7 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 6 mentions; 2 submissions, 4 comments20222023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 12 mentions; 3 submissions, 9 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 12 mentions; 4 submissions, 8 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC101
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC431
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC1129
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC927
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC624
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC202
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC211
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC1239
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC1248

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
npm - a JavaScript package manager Requirements You should be running a currently supported version of Node.js to run npm. For a list of which versions of Node.js are currently supported, please see the Node.js releases page. Installation npm comes bundled with node, & most third-party distributions, by default. Officially supported downloads/distributions can be found at: nodejs.org/en/download Direct Download You can download & install npm directly from npmjs.com using our custom install.sh script: curl -qL https://www.npmjs.com/install.sh | sh Node Version Managers If you're looking to manage multiple versions of Node.js &/or npm, consider using a node version manager Usage npm <command> Links & Resources Documentation - Official docs & how-tos for all things npm Note: you can also search docs locally with npm help-search <query> Bug Tracker - Search or submit bugs against the CLI Community Feedback and Discussions - Contribute ideas & discussion around the npm registry, website & CLI RFCs - Contribute ideas & specifications for the API/design of the npm CLI Service Status - Monitor the current status & see incident reports for the website & registry Project Status - See the health of all our maintained OSS projects in one view Support - Experiencing problems with the npm website or registry? File a ticket Acknowledgments npm is configured to use the npm Public Registry at https://registry.npmjs.org by default; Usage of this registry is subject to Terms of Use available at https://npmjs.com/policies/terms You can configure npm to use any other compatible registry you prefer. You can read more about configuring third-party registries FAQ on Branding Is it "npm" or "NPM" or "Npm"? npm should never be capitalized unless it is being displayed in a location that is customarily all-capitals (ex. titles on man pages). Is "npm" an acronym for "Node Package Manager"? Contrary to popular belief, npm is not an acronym for "Node Package Manager." It is a recursive backronymic abbreviation for "npm is not an acronym" (if the project were named "ninaa," then it would be an acronym). The precursor to npm was actually a bash utility named "pm", which was the shortform name of "pkgmakeinst" - a bash function that installed various things on various platforms. If npm were ever considered an acronym, it would be as "node pm" or, potentially, "new pm".
Read the full README on GitHub

What Hacker News says

12 sources
buu700·Nov 27, 2025
I recently learned that this is (for all intents and purposes) a feature in npm as well, specifically the `--before` flag to `npm install`: https://docs.npmjs.com/cli/v11/commands/npm-install#before. That was harder than it should've been to figure out; it really needs better marketing. Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issuecomment-33004136.... So rather than merely saying "I only want package versions more than N days old", you'd be adding the requirement that "...and also they should have gone at least N days without a subsequent patch release". e.g. if mylib@6.0.0 is released, only to be quickly followed by 6.0.1 and 6.0.2, you ideally wouldn't want to risk ever installing the probably-broken 6.0.0 or 6.0.1 based on luck of the draw; the better b
Read the rest
ehavior would be to stick with the last 5.x release until 6.0.2 has aged past the threshold.
In Show HN: Safe-NPM – only install packages that are +90 days old
Mattwmaster58·Sep 18, 2025
> Is that possible? This comes up every time npm install is discussed. Yes, npm install will "ignore" your lockfile and install the latest dependancies it can that satisfy the constraints of your package.json. Yes, you should use npm clean-install. One shortcoming is the implementation insists on deleteing the entire node_modules folder, so package installs can actually take quite a bit of time, even when all the packages are being served from the npm disk cache: https://github.com/npm/cli/issues/564
In Pnpm has a new setting to stave off supply chain attacks
Mattwmaster58·Sep 8, 2025
As others have noted, npm install can/will change your lockfile as it installs, and one caveat for the clean-install command they provide is that it is SLOW, since it deletes the entire node_modules directory. Lots of people have complained but they have done nothing: https://github.com/npm/cli/issues/564 The npm team eventually seemed to settle on requiring someone to bring an RFC for this improvment, and the RFC someone did create I think has sat neglected in a corner ever since.
In NPM debug and chalk packages compromised
cstrahan·Sep 8, 2025
> The alternative is to import packages directly from the (git) repository. That sounds great in theory. In practice, NPM is very, very buggy, and some of those bugs impact pulling deps from git repos. See my issue here: https://github.com/npm/cli/issues/8440 Here's the history behind that: Projects with build steps were silently broken as late as 2020: https://github.com/npm/cli/issues/1865 Somehow no one thought to test this until 2020, and the entire NPM user base either didn't use the feature, or couldn't be arsed to raise the issue until 2020. The problem gets kinda sorta fixed in late 2020: https://github.com/npm/pacote/issues/53 I say kinda sorta fixed, because somehow they only fixed (part of) the problem when installing package from git non-globally -- `npm install -g whatever` is still completely broken. Again, somehow no one th
Read the rest
ought to test this, I guess. The issue I opened, which I mentioned at the very beginning of this comment, addresses this bug. Now, I say "part of of the problem" was fixed because the npm docs blatantly lie to you about how prepack scripts work, which requires a workaround (which, again, only helps when not installing globally -- that's still completely broken); from https://docs.npmjs.com/cli/v8/using-npm/scripts: prepack - Runs BEFORE a tarball is packed (on "npm pack", "npm publish", and when installing a git dependencies). Yeah, no. That's a lie. The prepack script (which would normally be used for triggering a build, e.g. TypeScript compilation) does not run for dependencies pulled directly from git. Speaking of TypeScript, the TypeScript compiler developers ran into this very problem, and have adopted this workaround, which is to invoke a script from the npm prepare script, which in turn does some janky checks to guess if the execution is occuring from a source tree fetched from git, and if so, then it explicitly invokes the prepack script, which then kicks off compiler and such. This is the workaround they use today: https://github.com/cspotcode/workaround-broken-npm-prepack-b... ... and while I'm mentioning bugs, even that has a nasty bug: https://github.com/cspotcode/workaround-broken-npm-prepack-b... Yes, if the workaround calls `npm run prepack` and the prepack script fails for some reason (e.g. a compiler error), the exit code is not propagated, so `npm install` will silently install the respective git dependency in a broken state. How no one looks at this and comes to the conclusion that NPM is in need of better stewardship, or ought to be entirely supplanted by a competing package manager, I dunno.
In NPM debug and chalk packages compromised
sensanaty·Jul 23, 2025
In my case, stylus is a transient dependency of a transient dependency of a transient dependency... Vite has had stylus as an OPTIONAL peer dependency for a very long time now, and stylus itself has existed for MANY years. What NPM did here is eradicate every single version of stylus ever published, so the breakage for the large majority of people here is that NPM will now try to fetch a non-existent package, which will cause CI and other scripts that rely on `npm ci` or `npm i` to fail. It's one thing to get a big scary warning saying "Hey, stylus has a vulnerability, here's an overview of the issue..." and then pushing out the overwritten version as its own standalone version that people can migrate to. Instead, NPM silently overtook a package and overrode it completely. Running `npm audit` in a project affected by this, I see 0 mention
Read the rest
of stylus in it, there is ZERO indication anywhere that something about this package is wrong other than the fact that the package basically doesn't exist in the registry anymore. And in my testing so far, things like `package.json` `overrides` fields does not work [1]. So I wouldn't say this is your typical vulnerability situation. They pulled packages with 0 warning or notice to anyone, and their own security audit tooling gives you nothing to go by, and there seems to be basically nothing you can do to fix this, depending on how exactly your project is setup. We're not even sure there is an actual attack or vulnerability, because they don't link to any details literally anywhere! Just take a look at the NPM page [2], there are ZERO details here! And even weirder (could be that NPM just doesn't count downloads this early into a change's lifecycle), the downloads for the version they override is sitting at 0, to me indicating that nobody has been able to even download this, which I can confirm at least anecdotally from me trying to fix this issue myself. [1] https://github.com/npm/cli/issues/4232 [2] https://www.npmjs.com/package/stylus
In NPM stylus package contained malicious code and was removed from the registry

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.