pnpm
pnpm/pnpmReviewed by AI
What it does
pnpm is a command-line package manager for JavaScript and Node.js projects: it installs a project's dependencies, keeps a lock file so everyone gets the same versions, and manages groups of projects in one repository. Instead of copying the same files into every project, it stores each file once and links it, which the project says saves gigabytes and makes installs up to twice as fast. It is for developers; it runs in a terminal on Windows, macOS and Linux, and recent versions can also install Node.js itself.
How easy it is to install
B · installer plus one simple step · Windows
- Windows B
- macOS B
- Linux B
Each release has a ready standalone program for Windows (.zip), macOS and Linux (.tar.gz), around 21 to 27 MB, so there is nothing to compile; the extra step is putting it where your terminal can find it, or following the install page at pnpm.io, and from then on everything happens with typed commands inside a code project. Installing it the other common way, through npm, assumes Node.js is already on the machine.
Numbers on GitHub
- Stars
- 36,977on Oct 31, 2026
- Downloads
- 43,328,7581,450,992 this week
- Growth
- +48stars in 5 days
Stars over time
Facts
- Runs on
- Windows, macOS, Linux
- You need to install
- Nothing extra
- To build from source
- Node.js, Rust
- Disk space
- 23 MB–69 MB · from the installer
- Accounts or keys
- None
- Cost
- Free · Free and MIT-licensed, funded through sponsors on OpenCollective. The pnpr/ folder in the same repository is under a different, non-open-source licence.
- License
- MIT (Permissive)
- Last update
- Oct 31, 2026
Risk signals (3)
- Attentionpart of the repository is not open source
README, License: "MIT, except the pnpr/ directory, which is source-available under the PolyForm Shield License 1.0.0". The pnpr folder holds a package registry server (pnpr crates listed in Cargo.toml); its code can be read but PolyForm Shield is not an open-source licence and restricts use that competes with the project.
AI review
- Attentionit downloads runtimes and package code by itself
A package manager fetches other people's code from a registry and runs their install scripts on your machine. This repository's own package.json shows the pattern: devEngines declares "packageManager" pnpm 12.16.1 and "runtime" node 26.13.0, each with "onFail": "download", so the tool fetches a package manager and a Node.js runtime when they are missing.
AI review
- Infotwo major lines and an in progress rust rewrite
The README says it "Includes pacquet, an experimental port of the CLI written in Rust", the repository's main language is now Rust, and on 2026-10-30 the project published both v12.17.0 and v11.28.10. The version 12 downloads are around 22 MB against about 50 MB for version 11, so the program you get differs a lot depending on the line you pick, out of 1200 releases.
AI review
Evidence is shown in its original language.
What Radar could not check
- Whether installs really are up to twice as fast, which depends on your project, disk and network
- How much disk space you save, since that depends on how many projects share the same dependencies
- What the packages it installs do once their install scripts run
- Disk use of the program itself, estimated at 23 to 69 MB, not counting the shared store it builds
- Whether the experimental Rust version behaves the same as the older one on your project