Automic Vault

brew 软件包情报

安装 node

查看 node 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

安装

使用 Automic Vault 安装

Automic Vault
下载 AV
sudo av install brew:node

macOS

Homebrew 已验证 · 100%
brew install node

local Homebrew formula metadata

MacPorts 已验证 · 94%
sudo port install nodejs24

MacPorts ports tree · lang/nodejs24/Portfile · 来源: api.github.com

Linux

Alpine Linux apk 已验证 · 92%
sudo apk add nodejs

Alpine Linux edge package indexes · nodejs · 来源: dl-cdn.alpinelinux.org

Debian apt 已验证 · 92%
sudo apt install nodejs

Debian stable package indexes · nodejs · 来源: deb.debian.org

Fedora dnf 已验证 · 92%
sudo dnf install nodejs24

Fedora Rawhide package metadata · nodejs24 · 来源: dl.fedoraproject.org

Nix 已验证 · 92%
nix profile install nixpkgs#nodejs

nixpkgs package indexes · nodejs · 来源: raw.githubusercontent.com

Arch Linux pacman 已验证 · 92%
sudo pacman -S nodejs

Arch Linux sync databases · nodejs · 来源: geo.mirror.pkgbuild.com

openSUSE zypper 已验证 · 92%
sudo zypper install nodejs24

openSUSE Tumbleweed package metadata · nodejs24 · 来源: download.opensuse.org

Windows

Chocolatey 已验证 · 92%
choco install nodejs

Chocolatey community package catalog · nodejs · 来源: community.chocolatey.org

Scoop 已验证 · 92%
scoop install main/nodejs

Scoop official bucket manifest trees · bucket/nodejs.json · 来源: api.github.com

Windows Package Manager 已验证 · 92%
winget install --id OpenJS.NodeJS -e

Windows Package Manager source index · OpenJS.NodeJS · 来源: cdn.winget.microsoft.com

平台说明

  • 没有特定于此软件包的平台说明。

概览

软件包摘要

Automic Vault 根据本地软件包数据发布 node 的安装路径、可执行文件事实和安全元数据。

命令和别名

  • node
  • npm
  • npx

来源摘要

Open-source, cross-platform JavaScript runtime environment

radioisotope

Plain Text Publishing Token

`npm publish` commonly relies on an auth token stored in ~/.npmrc. Our isotope stores that token in the macOS keychain and injects it only when `npm publish` runs.

风险分类器

yellow 风险 · high 置信度 · runtime

原因

  • doc example: JavaScript runtime and package ecosystem

信号

  • override:node

安装行为

  • Homebrew declares a post-install hook for this formula.
  • Homebrew bottle metadata is available for 6 platform targets.
  • 安装时包含 17 个运行时依赖。
  • 构建元数据列出 2 个构建依赖。

本地 README 摘录

Node Radioisotope

This radioisotope modifies the Homebrew node package, but only changes the installed npm launcher. node and npx continue to run without isotope credential injection.

Security Model

Plaintext npm publishing tokens are commonly stored in ~/.npmrc as _authToken entries. The migration stores one token in the Automic Vault isotope keychain as NODE_AUTH_TOKEN and rewrites matching npm config entries to reference ${NODE_AUTH_TOKEN}.

The post-install hook wraps /opt/node/bin/npm. The wrapper injects NODE_AUTH_TOKEN only when an npm publish invocation is detected, then execs the original npm launcher.

Caveats

  • Only one npm publishing token is supported.
  • Multiple distinct _authToken values fail migration and must be handled

manually.

  • Project-level npm configs are not migrated; only the npm user config is

inspected.

来源: data/radioisotopes/node/README.md

Caveats

  • We currently support one npm publishing token.
  • Existing npm config entries are rewritten to reference NODE_AUTH_TOKEN.

审批门

Human review metadata for risky commands

The local approval-gate seed includes 7 rules for node. Covered entrypoints: corepack, node, npm, npx. Severity labels: critical, high, medium. Coverage: partial, 已审查 2026-05-21.

受控操作示例

  • Execute inline JavaScript supplied on the command line.
  • Load custom import hooks or require hooks before executing code.
  • Publish a package to the npm registry.
  • Install npm packages into a global executable location.
  • Remove package versions from the npm registry.
  • Download and execute a package by name.
  • Download and activate a package-manager shim.

可执行文件

已安装的可执行文件

命令类型暴露范围备注
nodecliglobal executable
npmcliglobal executable
npxcliglobal executable

新鲜度

版本和新鲜度

这些信号区分页生成时间、软件包管理器活动和上游发布比较。只有存在证据 URL 和可比较版本时,才会提示版本落后。

页面生成时间2026-05-26
管理器版本26.0.0
管理器更新时间2026-05-08
本地数据ok
上游not checked
检测到的最新版本未检测到

https://nodejs.org/

  • info Release/tag comparison is only available for GitHub repositories. https://nodejs.org/ none 置信度

安装元数据

软件包元数据

软件包键brew:node
版本26.0.0
软件包管理器Homebrew
软件包管理器页面https://formulae.brew.sh/formula/node
主页https://nodejs.org/
上游文档https://nodejs.org/
许可证MIT
源码归档https://nodejs.org/dist/v26.0.0/node-v26.0.0.tar.xz
更新2026-05-08T04:15:56Z
Pulseupdated
依赖ada-url, brotli, c-ares, hdrhistogram_c, icu4c@78, libnghttp2, libnghttp3, libngtcp2, libuv, llhttp, merve, nbytes, openssl@3, simdjson, sqlite, uvwasi, zstd
构建依赖pkgconf, python@3.14
macOS 提供的库python
Bottle可用 (arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-install已定义
服务未声明

来源线索

由仓库数据生成

此页面由 scripts/generate-pkg-pages.py 写入。如果 www/pkg/ 相对于本地软件包数据已过期,部署会拒绝发布。

使用的来源

  • Geiger risk classifier
  • Nucleus package database
  • approval-gate seed metadata
  • cross-ecosystem install command graph
  • local isotope README
  • package relationship graph
  • package version freshness
  • package-page enrichment
  • radioisotope security manifest