snpm
What it is
snpm is an open-source, Rust-native package manager for Node.js projects and JavaScript workspaces. It offers npm-style install, add, run, exec, and dlx commands, with workspace filters based on names, globs, paths, dependency walks, and Git references. When snpm-lock.yaml is missing, it can import pnpm, Bun, Yarn, or npm lockfiles, then use its own lockfile as the source of truth. Packages are downloaded once into a shared store and linked through a node_modules/.snpm virtual store. Security defaults block dependency lifecycle scripts unless allowed, can exclude newly published packages, and scope tarball authentication to the announcing registry. The CLI includes auditing with attempted fixes and SARIF output, dependency inspection, license listing, patching, publishing, and store maintenance. Publishing supports workspace fan-out, tags, OTP, and dry runs. An included Node version manager handles discovery through .node-version, .nvmrc, and engines.node. Prebuilt binaries support macOS, Linux, and Windows on x64 and arm64.
For and against
For
- Open-source MIT or Apache-2.0 licensing
- Supports major package lockfiles
- Shared package store reduces repeated downloads
- Built-in audit and SARIF output
- Includes a Node version manager
Against
- Install script requires Node.js 18 or newer
- Exact pnpm edge-case compatibility is evolving
- Unusual package layouts may not work identically
- Performance figures are site-reported
The verdict
snpm combines familiar npm-style commands with workspace, security, publishing, and Node version features. Its evolving compatibility makes it worth evaluating for projects that depend on unusual layouts or exact pnpm behavior.
Who it suits
snpm suits developers managing Node.js projects or JavaScript workspaces across macOS, Linux, and Windows. It is especially relevant to users wanting open-source tooling with lockfile, workspace, audit, and publishing support.
On the record
- Architecture
- Pre-built native binaries support macOS, Linux and Windows on x64 and arm64.snpm.io · read 1 Oct 2026
- Audit
- The audit command can find vulnerable dependencies, attempt fixes and emit SARIF output.snpm.io · read 1 Oct 2026
- CLI features
- The CLI includes audit with SARIF output, dependency inspection, license listing, patching, packing, publishing, and store maintenance commands.snpm.io · read 2 Oct 2026
- Compatibility status
- The project says exact pnpm behavior across every CLI edge case and compatibility with unusual package layouts are still evolving.github.com · read 2 Oct 2026
- Installation requirement
- The npm install script requires Node.js 18 or newer.snpm.io · read 1 Oct 2026
- Install methods
- The documentation describes installation from npm, GitHub Release binaries, or source.snpm.io · read 2 Oct 2026
- Install performance
- The site reports a 14.3-second cold-cache install and a 1.2-second warm-cache install in its React app benchmark, tested on a MacBook Pro M1 with Node 20.x.snpm.io · read 2 Oct 2026
- License
- The site states that snpm is open source and licensed under MIT or Apache-2.0.snpm.io · read 2 Oct 2026
- Lockfiles
- It reads pnpm, Bun, Yarn, and npm lockfiles on the first install, then uses snpm-lock.yaml as its source of truth.snpm.io · read 2 Oct 2026
- Node manager
- snpm includes a Node version manager with install, use, .node-version, .nvmrc and engines.node discovery.snpm.io · read 1 Oct 2026
- Node version management
- snpm includes an nvm-style Node version manager.snpm.io · read 2 Oct 2026
- Package age control
- The SNPM_MIN_PACKAGE_AGE_DAYS setting can be used to avoid newly published packages.snpm.io · read 2 Oct 2026
- Package store
- Packages are downloaded once into a shared store and linked into projects through a node_modules/.snpm virtual store.snpm.io · read 1 Oct 2026
- Performance claim
- The homepage reports a 1.2-second warm-cache install and says snpm is 50% faster than pnpm in its benchmark.snpm.io · read 1 Oct 2026
- Product
- snpm is a Rust-native package manager for JavaScript and Node.js projects.snpm.io · read 2 Oct 2026
- Protocols
- Supported protocols include npm, jsr, file:, git:, workspace: and catalog:.snpm.io · read 1 Oct 2026
- Publishing
- snpm supports pack and publish workflows with workspace fan-out, distribution tags, OTP and dry-run modes.snpm.io · read 1 Oct 2026
- Security
- Dependency install scripts are blocked unless allow-listed, and tarball authentication is scoped to the announcing registry.snpm.io · read 2 Oct 2026
