pkg.sopackage field notes

brew / portes d'approbation / rang 5

Installer node avec Homebrew

Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de node pour les workflows d'agents IA.

sécurité des agents

Réponse sur la sécurité des agents

node executes JavaScript tooling that commonly reads project secrets and launches npm package workflows.

Accès aux identifiants

Reads environment variables, dotenv files, npm tokens, and project config reachable to scripts.

Modification distante

Can run deploy scripts, API clients, and arbitrary package scripts.

Risque de publication ou d'artéfact

Can build and publish npm packages or generated application bundles.

Contrôle recommandé

Gate package publishing and lifecycle scripts; scan project secrets before agent runs.

Conseils d'utilisation par les agents

Allow test/build commands after scanning; require approval for publish, install scripts, and deploy actions.

installation

Commandes d'installation supplémentaires

macOS

Homebrewvérifié · 100%
brew install node

provider-native install command

aperçu

Résumé du paquet

Open-source, cross-platform JavaScript runtime environment

Commandes et alias

  • node
  • npm
  • npx

historique

Historique du projet et usages

Node.js is the JavaScript runtime that made server-side and command-line JavaScript mainstream. The official Node.js about page describes it as an asynchronous event-driven runtime designed for scalable network applications, with HTTP as a first-class feature and an event loop hidden behind ordinary JavaScript program execution.

Historique du projet

Ryan Dahl created Node.js around 2009 to run JavaScript outside the browser for network servers and other I/O-heavy programs. The runtime combined Google's V8 JavaScript engine with an event loop and low-level I/O APIs, giving web developers a single language across browser code, servers, tooling, and package scripts.

The early project was stewarded by Joyent, then hit a governance crisis in 2014 when prominent contributors forked it as io.js. The Node.js Foundation announced on 14 September 2015 that Node.js v4.0.0 combined the Node.js and io.js codebases under the foundation, added a long-term support plan, and moved the project to regular semver-based release lines.

The Node.js Foundation and JS Foundation announced their merger into the OpenJS Foundation on 12 March 2019. That put Node.js under the broader vendor-neutral JavaScript foundation that also houses projects such as Node-RED.

Historique d'adoption

Node.js adoption grew because it solved several developer and operational needs at once: fast startup for scripts, non-blocking network servers, JSON-native APIs, a giant npm ecosystem, and one language for browser and server teams. The 2015 foundation announcement said Node.js was used by tens of thousands of organizations in more than 200 countries and had more than 2 million downloads per month.

Homebrew's `node` formula is the rolling mainstream macOS/Linux package for the latest Node major. The Formulae page lists aliases including `node.js`, `node@26`, `nodejs`, and `npm`, and reports 3,116,013 installs over 365 days with 2,515,719 installs on request. Within Homebrew, that makes it the high-volume default path for developers who want Node, npm, and npx without a separate version manager.

Modes d'utilisation

Homebrew users install the rolling formula with `brew install node`, then get `node`, `npm`, and `npx`. The formula is convenient for system-level CLI tools, local development, and build dependencies, while teams that need exact per-project versions often layer nvm, fnm, asdf, volta, nodenv, or Homebrew's versioned `node@` formulas on top of that ecosystem.

Package nerds care about Node's release train because C++ addons, ESM/CommonJS behavior, OpenSSL, V8, npm, Corepack, test runner behavior, and web-platform APIs can all change across majors. The official release page explains that major versions historically enter Current for six months, even-numbered releases become LTS, and production applications should use Active LTS or Maintenance LTS releases.

Pourquoi les passionnés de paquets s'y intéressent

For package-manager data, `brew:node` is the anchor package. It is both a runtime and a build input for huge parts of the JavaScript, frontend, Electron, language-server, and CLI-tooling worlds. Its adoption stats often reflect not only developers explicitly wanting Node, but also downstream packages whose builds or runtime scripts need Node available.

Chronologie

  • 2009: Ryan Dahl creates Node.js and presents the early runtime publicly.
  • 2014: io.js fork forms during the Node.js governance dispute.
  • 2015-09-14: Node.js v4.0.0 reunifies Node.js and io.js under the Node.js Foundation and introduces the modern LTS direction.
  • 2019-03-12: Node.js Foundation and JS Foundation announce the OpenJS Foundation merger.
  • 2026: Homebrew's rolling `node` formula tracks Node 26.x and lists node@24, node@22, node@20, and node@18 as adjacent versioned formulas.

Related projects

  • npm
  • npx
  • Corepack
  • V8
  • libuv
  • OpenJS Foundation
  • io.js

portes d'approbation

Métadonnées de revue humaine pour commandes risquées

La graine locale de portes d'approbation contient 7 règles pour node. Points d'entrée couverts : corepack, node, npm, npx. Niveaux de sévérité : critique, élevé, moyen. Couverture : partial, revu le 2026-05-21.

Exemples d'actions contrôlées

  • Execute inline JavaScript supplied on the command line.
  • Load custom import hooks or require hooks before executing code.
  • Publish a package to the npm registry.
  • Install npm packages into a global executable location.
  • Remove package versions from the npm registry.
  • Download and execute a package by name.
  • Download and activate a package-manager shim.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
~/.npmrc
Windows
%UserProfile%\.npmrc

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
~/.npmrc
Windows
%UserProfile%\.npmrc

exécutables

Exécutables installés

CommandeTypeExpositionNote
nodeexécutableexécutable indexéDécouvert depuis l'index local des exécutables.
npmexécutableexécutable indexéDécouvert depuis l'index local des exécutables.
npxexécutableexécutable indexéDécouvert depuis l'index local des exécutables.

fraîcheur

Version et fraîcheur

Ces signaux séparent l'âge de génération de la page, l'activité du gestionnaire de paquets et la comparaison avec les versions amont. Un retard de version n'est signalé que lorsqu'une URL de preuve et des versions comparables sont présentes.

page générée2026-08-03
version du gestionnaire26.5.1
gestionnaire mis à jour2026-07-31
données localesinconnu
amontnon disponible
dernière version détectéenon détecté
  • OKAucun avertissement de fraîcheur n'a été généré.

métadonnées d'installation

Métadonnées du paquet

Clé du paquetbrew:node
Version26.5.1
Gestionnaire de paquetsHomebrew
Page d'accueilhttps://nodejs.org/
Dépôthttps://github.com/nodejs/node
Dernière mise à jour2026-07-31T17:47:51Z
Pulseupdated
Bouteillenon enregistré
Serviceaucun déclaré

piste source

Généré depuis les données du dépôt

Cette page est servie par av-web depuis l'artéfact SQLite privé des paquets généré par scripts/generate-pkg-sqlite.py.

Sources utilisées

  • Geiger risk classifier
  • Nucleus package database
  • approval-gate seed metadata
  • curated agent safety answer
  • curated configuration and credential file locations
  • curated package history
  • pkgdb category and tag curation