Fast, disk space efficient package manager | pnpm

Get lightning-fast installation speeds and a smarter, safer way to manage dependencies.
OSS projects that use pnpm
Measured on a real project, across the states an install actually happens in — from a fresh clone to a warm re-run. Reproducible, and rebuilt on every deploy.
pnpm is a drop-in replacement for npm — and then keeps going, with the features large repos actually need.
Resolution, fetching and linking happen in parallel instead of one stage at a time. On a warm store, an install is mostly just creating links.
Files inside node_modules are hard-linked from a single content-addressable store. A hundred projects on the same version cost you one copy on disk.
First-class monorepos: the workspace protocol for local packages, filtering to run tasks on just the projects you touched, and a single lockfile for everything.
Define a dependency version once in pnpm-workspace.yaml and reference it as "catalog:" everywhere. One line to upgrade, and no more version-drift merge conflicts.
Only your declared dependencies land in the root of node_modules, so your code can never quietly import a package you never installed.
Install scripts don’t run for arbitrary dependencies. You approve which packages may execute build scripts — supply-chain safety without extra tooling.
Fix a bug in a package without waiting for upstream — "pn patch" writes a persistent patch that is reapplied on every install.
Install and pin Node.js per project straight from pnpm — no nvm, no shell hooks, no “works on my machine” version mismatches.
Other package managers copy the same files into every project. pnpm keeps one copy and links to it — that single design decision is where the speed and the disk savings come from.
One copy per file, not per project
With npm, 100 projects using the same dependency means 100 copies on disk. pnpm stores every file once in a content-addressable store and hard-links it into each node_modules.
Updates only store what changed
If a new version of a package changes one file out of a hundred, pnpm adds exactly one file to the store instead of cloning the whole package again.
A node_modules you can trust
pnpm symlinks only your declared dependencies into the root of node_modules, so your code can never quietly import a package you never installed.
Resolve, fetch and link in parallel
Instead of finishing each stage before starting the next, pnpm links every package as soon as it is available — which is why installs feel instant on a warm store.
of every file on your disk, shared across all projects
extra disk space when a project reuses a version you already have
no access to undeclared dependencies, by default
Compromised packages get published. pnpm makes sure they don’t get to run on your machine — no extra tools, no configuration.
3 of 4 protections are on out of the box
Dependencies can’t run postinstall scripts unless you approve them. A compromised release can’t execute code the moment it’s installed.
Versions published less than 24 hours ago are skipped. Malware is usually caught and pulled within hours, before it ever reaches you.
Transitive dependencies can’t pull code from git repositories or raw tarball URLs, only from your trusted registries.
Refuse a version whose publishing trust got weaker, like a package that used trusted publishing and suddenly doesn’t.
Learn more in Mitigating supply chain attacks.
Everything npm does, plus the features that make large repos manageable.
See the full feature comparison in the documentation.
New features, fixes and security updates ship almost every week. Each square is a day; coloured ones shipped a release.
Teams switch to pnpm for the speed and stay for how cleanly it handles dependencies and monorepos.
Our goal is zero open bug reports at all times. A bug with steps to reproduce is picked up quickly and fixed as soon as possible.
Open an issue with the steps, or a small repository, that reproduce the bug.
Reproducible bugs go to the top of the queue. The issue list is kept at zero.
Fixes ship quickly, usually in the next patch or minor release.
Issues are for bugs only. Feature requests and questions live in GitHub Discussions.