snpm
snpm is a Rust-native package manager for Node.js projects and JavaScript workspaces.
What snpm is
snpm is a Rust-native package manager for Node.js projects and JavaScript workspaces. It provides npm-style commands such as install, add, run, exec, and dlx, and supports workspace filters by name, glob, path, dependency walk, and git reference. When snpm-lock.yaml is absent, it can import pnpm, Bun, Yarn, and npm lockfiles, then treats snpm-lock.yaml as the source of truth. Packages are downloaded into a shared store and linked into projects through a node_modules/.snpm virtual store. Install scripts are blocked unless explicitly allowed; users can also exclude recently published packages and scope tarball authentication to the announcing registry. The CLI includes auditing for vulnerable dependencies, attempted fixes, and SARIF output, as well as package publishing workflows. An included Node version manager supports version discovery through .node-version, .nvmrc, and engines.node. Pre-built binaries are available for macOS, Linux, and Windows on x64 and arm64. The project is open source under MIT or Apache-2.0; its npm install script requires Node.js 18 or newer.
Good
- Supports npm-style install, add, run, exec, and dlx commands
- Imports common package-manager lockfiles
- Blocks dependency lifecycle scripts by default
- Includes audit with SARIF output
- Open source under MIT or Apache-2.0
Watch out
- npm install script requires Node.js 18 or newer
- Exact pnpm behavior across every CLI edge case is evolving
- Compatibility with unusual package layouts is still evolving
Who it suits
snpm suits developers managing Node.js projects and JavaScript workspaces who want package installation, auditing, publishing, and Node version management in one CLI. It is available for macOS, Linux, and Windows.
Verdict
snpm covers package management, workspace operations, auditing, publishing, and Node version management across major desktop platforms. Its stated compatibility caveats matter if your workflow depends on unusual layouts or exact pnpm edge-case behavior.
The facts
Each one read from snpm's own pages, with the date it was checked.
What it does
- Architecture
- Pre-built native binaries support macOS, Linux and Windows on x64 and arm64.checked 1 Oct 2026
- Audit
- The audit command can find vulnerable dependencies, attempt fixes and emit SARIF output.checked 1 Oct 2026
- CLI features
- The CLI includes audit with SARIF output, dependency inspection, license listing, patching, packing, publishing, and store maintenance commands.checked 2 Oct 2026
- Compatibility status
- The project says exact pnpm behavior across every CLI edge case and compatibility with unusual package layouts are still evolving.checked 2 Oct 2026
- Installation requirement
- The npm install script requires Node.js 18 or newer.checked 1 Oct 2026
- Install methods
- The documentation describes installation from npm, GitHub Release binaries, or source.checked 2 Oct 2026
- Install performance
- The site reports a 14.3-second cold-cache install and a 1.2-second warm-cache install in its React app benchmark, tested on a MacBook Pro M1 with Node 20.x.checked 2 Oct 2026
- License
- The site states that snpm is open source and licensed under MIT or Apache-2.0.checked 2 Oct 2026
- Lockfiles
- It reads pnpm, Bun, Yarn, and npm lockfiles on the first install, then uses snpm-lock.yaml as its source of truth.checked 2 Oct 2026
- Node manager
- snpm includes a Node version manager with install, use, .node-version, .nvmrc and engines.node discovery.checked 1 Oct 2026
- Node version management
- snpm includes an nvm-style Node version manager.checked 2 Oct 2026
- Package age control
- The SNPM_MIN_PACKAGE_AGE_DAYS setting can be used to avoid newly published packages.checked 2 Oct 2026
- Package store
- Packages are downloaded once into a shared store and linked into projects through a node_modules/.snpm virtual store.checked 1 Oct 2026
- Performance claim
- The homepage reports a 1.2-second warm-cache install and says snpm is 50% faster than pnpm in its benchmark.checked 1 Oct 2026
- Product
- snpm is a Rust-native package manager for JavaScript and Node.js projects.checked 2 Oct 2026
- Protocols
- Supported protocols include npm, jsr, file:, git:, workspace: and catalog:.checked 1 Oct 2026
- Publishing
- snpm supports pack and publish workflows with workspace fan-out, distribution tags, OTP and dry-run modes.checked 1 Oct 2026
- Security
- Dependency install scripts are blocked unless allow-listed, and tarball authentication is scoped to the announcing registry.checked 2 Oct 2026
- Security defaults
- Dependency lifecycle scripts are blocked unless explicitly allowed, minimum package age can exclude recent publishes, and tarball authentication is scoped to the announcing registry.checked 1 Oct 2026
- Source availability
- The project is open source and links to its GitHub repository from the documentation and homepage.checked 1 Oct 2026
- Workflow
- It provides npm-style commands including install, add, run, exec and dlx.checked 1 Oct 2026
- Workspaces
- It discovers workspaces from snpm-workspace.yaml, pnpm-workspace.yaml, or package.json workspaces and supports filters.checked 2 Oct 2026
Where it runs
- Supported platforms
- The npm installer supports macOS, Linux, and Windows on x64 and arm64; Node.js 18 or later is required for its install script.checked 2 Oct 2026
