unjs / upm

⚡ A fast, tiny package manager for the npm registry, written in TypeScript.
- 🟦 **Pure JS:** built with TypeScript and Node.js builtins.
- 🪶 **Small:** about 320 kB on disk ( 107 kB packed), small enough to bundle into your own tools.
- 🚀 **Fast:** install speed on par with package managers written in Rust.
- 🧩 **Programmable:** every command is also a JavaScript function you can import.
- 🎯 **Simple:** no new config files or conventions. Your existing `.npmrc` just works.
- 🔒 **Secure:** defaults to a 1-day minimum release age and skips dependency lifecycle scripts.
- 📦 **Lockfile compatibility:** supports existing `package-lock.json`, `pnpm-lock.yaml` and `bun.lock` out of the box.
## 🤔 Why another package manager?
There are already several popular package managers:
- **npm** ships with Node.js, but it is simply slow.
- **pnpm** is fast and well designed, but it keeps growing in size, features and customization settings.
- **Yarn** (berry) has become complex, with its own concepts and unusual requirements.
- **Bun**, **Deno** and **Nub** are fast, but they fit best when you also use them as runtime and not Node.js.
Furthermore:
- 🟢 **Node.js is capable.** It already has worker threads, zlib, fetch and every other needed feature.
- 🦀 Native package managers are much larger to download and store on disk, for every version. In CI, just fetching the binary, even from a cache, can cost more time than it could save! Most of the bytes in these binaries are already native features that Node.js already has. In our benchmarks, pnpm 12 takes 59.8 MB and aube 44.5 MB on disk; upm ~ 320 kB .
- 🔌 **Programmatic API.** The only possible way to install dependencies is spawing command in a separate process. None of the current package managers are small enough to bundle and embed into another library.
💡 upm started as an experiment: how fast and small can an npm client be in pure TypeScript,
making the most of what Node.js already provides? And answer turned out to be possbile!
## Get started
Install upm globally. The scripts check for Node.js 22.3+, then install upm with npm.
 [code] 
Then install your project's dependencies:
 [code] 
> [!IMPORTANT]
> **Prerelease:** upm is not stable yet see current limits.
## Quick reference
 [code] 
Commit `upm.lock` with your `package.json`. When switching to upm, delete the old
`node_modules` first. Otherwise, your code may still import old packages.
Use `--dir ` to choose a project directory. Otherwise, install commands look
for the nearest `package.json` above the current directory, or the workspace root
that lists it. `--dir` uses the directory you give it; for a workspace tree, point
it at the root and use `-w` where supported.
Most commands support `--json` for machine-readable results. Progress and warnings
go to stderr. `upm lock --json` prints the lockfile **without writing it**.
See `upm --help` for all options, including experimental worker settings.
### Add and remove packages
 [code] 
`upm` alone and `upm i` a