pnpm

pnpm is a package manager and drop-in replacement for npm, available for Linux, macOS, Windows, and Android. It handles npm and JSR packages, Cargo crates, PyPI packages, tarballs, Git repositories, and local directories. Dependency resolution, fetching, and linking run in parallel, while package files are kept in a shared content-addressable store and linked into projects. Workspaces support monorepos with filtering, workspace protocols, and a shared lockfile. By default, only declared direct dependencies appear at the root of node_modules. Since pnpm v10, install scripts are disabled unless explicitly allowed. Other controls include blocking certain transitive dependencies, delaying updates, and applying trust policies; pnpm can also audit for known vulnerabilities and verify registry signatures. It can install and pin Node.js per project, and its standalone installer does not require Node.js. pnpm is free. The provided pages state no pricing, billing, trial, refund, or free-tier limit details.

pnpm combines package management with workspace features, dependency isolation, and supply-chain controls. It is free, though the provided pages do not specify billing or plan limits.

pnpm suits developers managing dependencies for projects, particularly monorepos that need workspace filtering and a shared lockfile. It also supports teams that want controls over install scripts and dependency trust.

Overview

pnpm is a package manager for JavaScript projects, built as a drop-in replacement for npm. It is best suited to teams managing multiple related packages or looking to reduce duplicated dependency storage. Its strongest case is the combination of workspace tooling, dependency isolation, and install-time controls.

Package files are kept in a shared content-addressable store and hard-linked into projects, while resolution, fetching, and linking run in parallel. That design can save disk space across projects and streamline installs; the project claims speeds of up to 2x npm and Yarn Classic, though results depend on the workload. pnpm handles npm and JSR registries, workspaces, local files, tarballs, Git repositories, and additional formats including Cargo crates and PyPI packages.

The repository is MIT-licensed except for the pnpr directory, which uses the PolyForm Shield License 1.0.0. That distinction is worth reviewing for organizations assessing licensing.

Key features

Workspaces and dependency consistency

For monorepos, pnpm offers workspace protocols, package filtering, and a shared lockfile. Dependency catalogs define versions centrally in pnpm-workspace.yaml, reducing repeated version declarations across packages. These features make pnpm a particularly practical fit for repositories that need coordinated dependency management; for a single small project, they may matter less.

Isolation and install security

By default, only declared direct dependencies appear at the root of node_modules, helping expose accidental reliance on undeclared packages. Since pnpm v10, package postinstall scripts are disabled unless explicitly approved. Teams can also block unusual transitive dependencies, delay updates with a default minimum release age of 1440 minutes, and apply trustPolicy. These controls provide useful safeguards, but require teams to decide which packages and scripts to trust.

Patching and runtime management

pn patch creates persistent patches that are reapplied on each install, useful when a project needs a durable change to a dependency. pnpm can also install and pin Node.js per project, helping teams keep runtime choices aligned.

Audit, signatures, and automation

pnpm audit checks for known vulnerabilities and can verify ECDSA registry signatures for installed packages. Documentation includes CI configuration examples for services including GitHub Actions, GitLab CI, Jenkins, and Azure Pipelines. The pnpm setup action for GitHub Actions can install pnpm and a requested runtime, run installation, and cache the pnpm store. Those integrations suit automated builds, though teams using other CI systems may need to adapt their setup.

Pricing

pnpm is free, with no free trial. The project offers no paid plan terms to weigh against the free option. There is no published plan breakdown or stated quota, seat cap, renewal term, or refund policy, so teams should not assume a particular service-level or billing arrangement. The core repository is MIT-licensed, subject to the pnpr licensing exception noted above.

Platforms

pnpm supports Linux, macOS, Windows, and Android. Installation instructions cover macOS, Linux, and Windows; a standalone installer script does not require Node.js, which is useful when setting up the package manager before a runtime is present.

Who it's for

pnpm is a strong choice for JavaScript teams with monorepos, shared dependencies, or a preference for stricter dependency boundaries. Its content-addressable store is also appealing to developers maintaining several projects that use overlapping packages. Teams that need a narrowly scoped tool for another language may prefer a package manager built specifically for that ecosystem, while projects with no workspace or isolation needs may have less reason to switch from their current npm-based workflow.

Pros and cons

• Pro: A shared store with hard-linked project files can limit duplicated package storage across projects.
• Pro: Workspace filtering and a shared lockfile give monorepo teams concrete ways to coordinate packages.
• Pro: Default dependency isolation and approval for install scripts offer safeguards against undeclared dependencies and unwanted script execution.
• Pro: Persistent patches, runtime pinning, audit checks, and registry signature verification cover needs beyond basic installation.
• Con: The workspace and supply-chain controls may add decisions and process for a simple project that does not need them.
• Con: The speed advantage is a project claim rather than a guarantee for every repository or installation pattern.
• Con: The pnpr directory has a different license from the rest of the repository, which adds a licensing check for some adopters.

Alternatives

Choose npm if you want the established JavaScript package manager and public registry publishing; its free plan covers public package publishing and use, with paid plans also offered. Yarn is another free package-manager option if you want an alternative in the same general category without stated paid plans or usage limits.

For projects in other ecosystems, uv is a free open-source Python package manager, while Cargo is a free Rust package manager and build tool. Conan is a free, open-source choice for C and C++ package and dependency management. Go Modules, vcpkg, and Gradle are other free options to consider.

Browse Package Managers, JavaScript Package Managers, or Monorepo Management Tools for more options by category.

Verdict

Choose pnpm if your JavaScript work benefits from shared dependency storage, coordinated monorepos, and explicit install controls. Those capabilities make it more compelling than a basic npm replacement for teams with multiple packages or tighter dependency policies. Look elsewhere if you need a language-specific manager, or if the workspace and security controls would add complexity without solving a real problem.