This page may contain stale information. Last updated: 2026-06-12
Overview
Node.js is a JavaScript runtime built on Chrome’s V8 engine, enabling server-side and tooling development. It ships with npm as its default package manager and powers the majority of modern web backends, build tools, and CLI utilities.
Ecosystem Scale
- Average npm project pulls in 79 transitive dependencies
- Combined weekly downloads of top packages exceed 2.6 billion (debug/chalk incident, September 2025)
- 455,000+ malicious npm packages published in 2025 alone
2026 Supply Chain Context
The Node.js/npm ecosystem faced escalating attacks in 2025–2026:
- September 2025: 18 popular packages (debug, chalk) hijacked — 2.6B weekly downloads affected
- March 2026: Axios package compromise via credential theft
- June 2026: miasma-worm — Red Hat (30+ packages) and Microsoft (73 repos) campaigns
- June 2026: npm v12 security defaults announced as structural response
npm v12 Impact on Node.js Developers
Native modules (sharp, bcrypt, node-sass) relying on implicit node-gyp rebuild will require explicit allowScripts approval. CI/CD pipelines running non-interactive npm install must pre-approve scripts or builds will fail after v12.