Mastering Node.js version management and npm registry sources like a pro

In continuation to the 10 npm security best practices guide we published earlier this year, I’d like to further explore how to make it easier to switch between different Node.js versions and to switch between different npm registries while working in a development environment.

Node version manager

When developing Node.js applications, you may need to install multiple versions of Node.js in order to handle your day-to-day tasks. This might happen, for example, if you need to solve a bug in production, or if you need to switch between projects. Doing this manually every single time can take a lot of effort and anyway—there is a better way.

Node Version Manager (nvm) is a tool that allows the user to switch between different versions of Node.js, helping reduce overhead when reproducing production bugs in development environments.

The default installation is only supported on macOS and Linux environments. If you are a Windows user, check out nvm-windows, which should cover your needs.

Using the CLI, you can install any Node.js version by running the following:

nvm install  8.9.4
nvm install node   # nvm install the latest release
nvm install --lts  # nvm install the latest LTS release

That was easy! Now let’s review some typical scenarios that show how NVM can help:

• Sometimes, some team members might work with a different Node.js version than others on the same team. This, however, is a common mistake and can get you into trouble, such as merging code that is not supported by the Node.js version that is used across the rest of the team. To enforce the version that all team members should use, the team can implement the `.nvmrc` file.For example:
  
  $ echo "10" > ~/.nvmrc
  
  Once installed, when a team member runs nvm install, it will always use the version listed in that file by default and prevent team members from contributing if using a different version. In this way, for instance, you avoid shipping any incompatible Node.js features or using syntax that might potentially break your app.

• Need to reproduce a bug in an older or newer Node.js version than the one you have installed? Without NVM, having multiple instances of globally installed npm versions at one time is daunting due to manual installs. With NVM however, just run another `install` command in order to run different parallel instances with different versions and you’re set. See example below

When you have installed multiple instances of Node.js, each with multiple global npm modules, you’ll need to re-install all of those modules over and over again, every time you change Node.js versions.

Here’s a quick solution for that:

$ nvm install 10 --reinstall-packages-from=8

NPM registry manager

NPM Registry Manager is another useful utility to have on hand if you’re making use of several registries, which is a common situation when working in an enterprise, or if you’re using a tool such as verdaccio for personal use on a local private registry. With GitHub’s launch of their package registry this is even more useful and common.

NRM supports several registries out of the box, including:

• npm: https://registry.npmjs.org

• cnpm: http://r.cnpmjs.org

• nj: https://registry.nodejitsu.com

$ nrm use cnpm

For more npm security productivity tips be sure to take a peek at our  10 npm security best practices guide cheat sheet.

Stay Secure!