Compared to npm, pnpm, and Bun
Compare package installation, security defaults, development tools, and registry support.
Compare npm, pnpm, Bun, and LPM CLI by their defaults and supported workflows.
All four support npm packages and private registries. LPM CLI also coordinates development tools, local infrastructure, and optional LPM.dev Registry services.
The feature tables use the source snapshots listed below. A dash means no built-in equivalent in that snapshot. External tools can extend each package manager.
Benchmarks
Install benchmarks use a T3 application fixture with 25 direct dependencies and development dependencies, including Next.js, React, tRPC, and Drizzle.
All values are median wall times from ten measured runs. Lower is better. Bold marks the lowest median in each row.
| Benchmark | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| First install | 13,787.5ms | 4,174ms | 1,825ms | 1,594.5ms |
| Fresh / warm | 3,318.5ms | 355ms | 191.5ms | 66ms |
| CI cold | 2,655.5ms | 3,455.5ms | 1,538ms | 1,374.5ms |
| CI warm | 2,293ms | 329.5ms | 186.5ms | 102ms |
| Installed / cache gone | 667.5ms | 10ms | 19ms | 12ms |
| Up to date | 440.5ms | 10ms | 19ms | 12ms |
See install benchmarks for peak memory, more package managers, and the full methodology.
Dev command benchmarks measure already-installed local scripts, local bins, and built-in tools.
| Benchmark | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
Package script: echo hi | 67.51ms | 13.63ms | 5.49ms | 10.68ms |
| Node startup + tiny script | 88.00ms | 34.02ms | 26.44ms | 30.21ms |
Local bin: esbuild --version | 133.51ms | 22.23ms | 8.16ms | 11.92ms |
| Run TSX app, warm cache | 200.36ms | 87.84ms | 6.21ms | 47.37ms |
| Lint 20 JS files (Oxlint) | 162.43ms | 50.71ms | 37.01ms | 16.57ms |
| Format check, 20 JS files (Biome) | 158.74ms | 46.56ms | 33.68ms | 15.47ms |
Measured on September 28, 2026, on an Apple M5 Pro with 48 GiB RAM.
Security defaults
These defaults apply to dependency packages. Root and workspace lifecycle scripts have separate rules and can still run.
| Control | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| Dependency lifecycle scripts | Blocked unless approved through allowScripts or npm approve-scripts. | Blocked unless approved through allowBuilds or pnpm approve-builds. Unreviewed builds fail the install by default. | Runs scripts for explicitly trusted packages, or its bundled trusted list when no explicit list exists. | Blocked until trusted. lpm approve-scripts saves approvals. lpm rebuild runs eligible scripts. |
| OS sandbox for dependency scripts | — | — | — | Filesystem restrictions and filtered environment. Outbound network is allowed by default. Strict mode denies it. |
| Minimum release age | Off. Configurable with min-release-age in days. | Prefers versions at least one day old. The default can fall back to younger versions. | Off. Configurable with minimumReleaseAge in seconds. | Off. Configurable release cooldown, with direct or strict transitive policy. |
Dependency engines.node | Warns by default. engine-strict can reject mismatches. | Warns by default. engineStrict can reject mismatches. | No install-time enforcement. | Enforced by default. Required incompatible dependencies fail. Optional-only incompatible packages are skipped. |
| Vulnerability audit | npm audit. Registry advisory reporting also runs during install by default. | pnpm audit, using registry advisory data. | bun audit, using registry advisory data. | lpm audit, using OSV and source analysis. Automatic post-install audit is opt-in. |
| Registry signature verification | npm audit signatures also verifies available provenance attestations. | pnpm audit signatures verifies registry signatures. | — | lpm audit signatures. Install-time signature enforcement is opt-in. |
| Install-time provenance policy | Attestation verification is a separate audit operation. | Optional trustPolicy: no-downgrade compares publication metadata. | — | Saved artifact approvals can trigger provenance verification and publisher-drift checks. Wider verification and no-downgrade policy are opt-in. |
| Custom install checks | Manifest extension hooks. | pnpmfile hooks. | Optional security scanner package, configured in bunfig.toml. | Optional LPM Firewall, source analysis, and local policy extensions. |
A script approval permits execution. It does not prove that a package is safe. Bun's explicit trustedDependencies replaces its fallback list. An empty list blocks all dependency scripts.
LPM CLI keeps script eligibility separate from execution. Approved scripts run through rebuild or the install auto-build rules. Root-project scripts do not use the dependency sandbox. Sandbox support depends on the operating system. An approved degraded mode can reduce isolation.
LPM CLI does not verify every package's provenance by default. Its default scope covers saved artifact approvals, and unavailable evidence is best-effort. Available invalid evidence fails verification. See signature and provenance configuration.
LPM CLI can require security approval before accepting weaker settings. Repository configuration cannot silently lower an approved security policy.
pnpm's built-in release-age preference differs from an explicit policy. Setting minimumReleaseAge makes strict enforcement the default unless minimumReleaseAgeStrict overrides it. Publication metadata ranking and cryptographic provenance verification are different checks.
Installs, storage, and lockfiles
| Capability | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
Default node_modules layout | Hoisted. linked, nested, and shallow are alternatives. | Isolated, with a symlinked virtual store. Hoisted and PnP layouts are alternatives. | New single-package projects use hoisted. New workspaces use isolated. Older Bun lockfiles and npm/Yarn migrations can retain hoisted defaults. | Hoisted for single-package projects. Isolated for workspaces and default installs with peer conflicts. Configurable linker. |
| Package storage | Content-addressable download cache. | Content-addressable package store. Hardlinks, reflinks, or copies. | Global package/version cache. Clones, hardlinks, or copies. Optional shared virtual store for isolated installs. | Content-addressable store. Copy-on-write clones or reflinks where available, with independent copies as fallback. |
| Lockfile | package-lock.json. Normally format 3, with format 4 for patches and manifest extensions. | pnpm-lock.yaml, format 9. | Text bun.lock for new projects. Existing bun.lockb remains supported. | Authoritative TOML lpm.lock. Generated lpm.lockb companion when the graph supports it. |
| Frozen install command | npm ci | pnpm install --frozen-lockfile | bun ci | lpm install --frozen-lockfile |
| Prepare dependencies for other platforms | --os, --cpu, and --libc override the install target. | supportedArchitectures retains optional packages for selected OS, CPU, and libc combinations. | Multiple --os and --cpu values select optional packages for several targets. | lpm fetch --platform fills the store for one target from the lockfile, without creating node_modules. |
| Dependency patches | npm patch add / npm patch commit | pnpm patch / pnpm patch-commit | bun patch / bun patch --commit | lpm patch / lpm patch-commit |
| Dependency overrides | overrides | overrides | overrides and resolutions | npm overrides, Yarn resolutions, and lpm.overrides. |
| Reusable dependency build artifacts | — | Side-effects cache enabled by default. Optional remote dependency-build cache. | — | Automatic native build cache for eligible strict-sandbox builds on macOS and Linux. |
| Lockfile migration | Can use Yarn lock data during installation. | pnpm import reads npm and Yarn lockfiles. | Imports npm, Yarn, and pnpm lockfiles. bun pm migrate can run without installing. | lpm migrate imports npm, pnpm, Yarn, and Bun lockfiles. |
Layout names do not guarantee identical dependency visibility. pnpm privately hoists dependencies by default. LPM CLI's hoisted layout exposes direct dependencies at the root and uses package-local dependency links. See dependency layouts.
Migration support depends on the source lockfile format and its features. The migration guides describe supported inputs and project changes.
Preparing packages for another platform does not make its native build scripts runnable on the host. LPM CLI fetches only packages already present in the lockfile.
Workspaces and package inspection
| Capability | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| Workspace selection | --workspace, --workspaces | --filter, recursive commands | --filter. bun run --workspaces | Workspace filters and affected-project selection. |
| Shared version catalogs | — | catalog and catalogs in pnpm-workspace.yaml. | catalog and catalogs in root package.json. | Catalogs in package.json or pnpm-workspace.yaml. |
| Deploy one workspace member | — | pnpm deploy | — | lpm deploy |
| Dependency queries | npm query uses CSS-like selectors. | pnpm list, pnpm why | bun pm ls, bun why | lpm query adds behavioral selectors and assertion gates. lpm graph exports visual graphs. |
| Source usage and dependency cleanup | External tools for source-usage analysis. | External tools for source-usage analysis. | bun install --analyze <files...> scans imports and adds dependencies. External tools for unused-dependency cleanup. | lpm tidy finds unused declarations and undeclared imports. --fix removes fixable unused declarations and reinstalls. |
| Package-content comparison | npm diff compares published packages or a local project. | External tools. | bun pm diff compares package versions, folders, or tarballs. | No general package-content diff command. |
| License inventory | License metadata in npm sbom. | pnpm licenses list | bun pm licenses | lpm licenses, with copyleft, missing-license, and explicit-denial gates. |
| Software bill of materials | npm sbom, SPDX or CycloneDX. | pnpm sbom, SPDX or CycloneDX. | — | lpm sbom, SPDX or CycloneDX. |
| Interactive upgrades | — | pnpm update --interactive | bun update --interactive | lpm upgrade, interactive on a terminal. |
| Dependency manifest repairs | Declarative packageExtensions, or .npm-extension.mjs / .npm-extension.cjs hooks. | packageExtensions adds missing declarations. .pnpmfile.mjs / .pnpmfile.cjs hooks support programmable transformations. | — | Policy extensions can allow, warn, or block candidates. They do not transform manifests. |
| Copy package source into a project | — | — | — | lpm add, for supported registry packages. |
Catalogs share version declarations across workspace members. They differ from overrides, which can replace dependency requirements in the resolved graph.
Source-usage analysis differs from pruning packages that are no longer declared. Static inspection can miss framework conventions or dynamic imports. Tidy exclusions preserve intentional dependencies.
Development tools and infrastructure
Bun includes its own JavaScript runtime, bundler, and test engine. LPM CLI manages runtimes and external tools, then coordinates their execution.
| Capability | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| Package scripts and one-off tools | npm run, npm exec, npx | pnpm run, pnpm exec, pnpm dlx | bun run, bunx | lpm run, lpm exec, lpm dlx. |
| Runtime management | Uses the installed Node.js runtime. | Manages Node.js, Bun, and Deno through pnpm runtime. | Built-in JavaScript and TypeScript runtime. | Manages Node.js and Bun through runtime configuration. |
| Project package-manager version | Uses the invoked npm version. devEngines can enforce requirements. | Automatically downloads and uses the requested pnpm version from project metadata. | Uses the invoked Bun version. | Uses the invoked LPM CLI version. |
| Task dependencies and result caching | Run scripts. Use a separate task-cache tool. | pnpm pipeline provides task dependencies and a local result cache. | Parallel and sequential script execution. No task-result cache. | Task graph and local cache, with optional remote cache. |
| Bundling | Project tooling. | Project tooling. | Built-in bun build. | lpm bundle manages Rolldown. lpm pack runs project-local tsdown. |
| Standalone executables | Separate Node.js or project tooling. | pnpm pack-app embeds a CommonJS entry and Node.js through Node SEA. | bun build --compile bundles application code and the Bun runtime, with cross-compilation and embedded assets. | Separate runtime or project tooling. |
| Test execution | npm test runs a package script. | pnpm test runs a package script. | Built-in bun test. | lpm test runs supported project test tools such as Vitest, Jest, and Mocha. |
| Linting, formatting, and type checking | Project tooling. | Project tooling. | Project tooling. TypeScript execution does not check types. | lpm lint and lpm fmt manage Oxlint and Biome. lpm check runs local tsc or managed tsgo. |
| Development server | Project scripts. | Project scripts. | HTML entrypoints and full-stack serving with hot-module replacement. | lpm dev coordinates servers, dependencies, services, environment variables, and readiness. Port management handles conflicts and supplies service URLs and ports. |
| Diagnosis and supported repairs | npm doctor examines the registry connection, versions, permissions, and cache. | pnpm doctor examines installation, filesystem, runtime, and registry state. | No general doctor command. | lpm doctor examines project, runtime, tool, and security state. --fix applies supported repairs. |
| Skill integration | External tools. | External tools. | External tools. | lpm skills manages standalone skills. Approved LPM.dev package guidance follows selected dependency versions. |
| Secrets | Environment variables or external tools. | Environment variables or external tools. | Automatic .env loading and OS-backed Bun.secrets APIs. | Encrypted environment vault, with optional team and cloud synchronization. |
| Local certificate authority | External tools. | External tools. | External tools. HTTPS serving accepts certificates. | Local HTTPS with certificate generation and trust management. |
| Public tunnels to localhost | External tools. | External tools. | External tools. | Tunneling, domain claims, and webhook inspection through LPM.dev Registry. |
pnpm's optional remote dependency-build cache stores package installation artifacts. It is separate from the local task-result cache in pnpm pipeline.
By default, pnpm run and pnpm exec check installed dependencies and install when needed. verifyDepsBeforeRun configures this behavior. The check does not support PnP layouts.
pnpm reads its requested version from devEngines.packageManager or packageManager. When Corepack invokes pnpm, pnpm leaves version selection to Corepack.
Bun also provides application APIs for PostgreSQL, MySQL/MariaDB, SQLite, Redis, and S3. These APIs run inside application code. They do not provision database servers. Applications launched through npm, pnpm, or LPM CLI can use their selected runtime's APIs and external libraries.
Standalone executables have target and dependency constraints. pnpm's Node SEA workflow requires a supported Node.js version and a CommonJS entry. Bun's cross-compilation also needs dependencies suitable for the target.
LPM CLI's automatic package guidance applies to approved skills on direct LPM.dev Registry dependencies. Standalone skills have separate installation and update workflows.
LPM CLI's local tools work without an LPM.dev Registry account. Hosted tunnels, environment synchronization, and hosted remote caching require the relevant service access.
Publishing and registries
All four tools support npm-compatible registries and scoped registry configuration. LPM CLI sends ordinary npm packages to npmjs.org by default. Only @lpm.dev/* always routes through LPM.dev Registry. See registry routing.
| Capability | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| Publish to an npm-compatible registry | npm publish | pnpm publish | bun publish | lpm publish, with registry selection. |
| Stage a release for approval | npm stage | pnpm stage | — | lpm stage supports upload, inspection, download, approval, and rejection. |
| Publish provenance | --provenance. Also automatic for eligible trusted publishing. | --provenance. Also automatic for eligible trusted publishing. | — | --provenance, with supported CI identity. |
| npm trusted publishing | GitHub Actions, GitLab CI, and CircleCI token exchange. | GitHub Actions identity requests or a supplied NPM_ID_TOKEN. | — | GitHub Actions identity requests or a supplied NPM_ID_TOKEN, including GitLab CI. |
| Swift packages | — | — | — | Swift package installation and registry configuration. |
| OTP when the registry requires it | Supported. | Supported. | Supported. | Supported. |
| Registry credential configuration | .npmrc, including environment substitution. | Login writes global config.yaml. .npmrc compatibility remains. | .npmrc or bunfig.toml, including environment-backed credentials. | OS secure store preferred, encrypted-file fallback, and .npmrc compatibility. |
Trusted publishing requires registry-side configuration for the package and CI identity. Token exchange and provenance generation have separate requirements. For example, npm's CircleCI exchange does not automatically generate provenance.
Staged publishing requires a registry that implements the npm staging API. The upload remains separate from approval and public availability.
LPM.dev Registry is an optional publishing destination. Packages are private by default, with Free, Pool, and Marketplace distribution available through explicit settings. See package distribution.
pnpm also provides pnpr, an optional registry server for resolution, package delivery, and dependency-build caching. It is separate from the public npm registry.
Platforms and updates
The source snapshots below include these native binary targets. npm uses Node.js, so its platform support also depends on a compatible Node.js installation.
| Platform | npm | pnpm | Bun | LPM CLI |
|---|---|---|---|---|
| macOS, Intel and Apple Silicon | Yes | Yes | Yes | Yes |
| Linux glibc, x64 and ARM64 | Yes | Yes | Yes | Yes |
| Linux musl, x64 and ARM64 | With a compatible Node.js build. | Yes | Yes | Official x64 binary. ARM64 requires a source build. |
| Windows x64 | Yes | Yes | Yes | Yes |
| FreeBSD | With a compatible Node.js build. | x64 | x64 and ARM64 | No official binary. |
| Self-update | npm install -g npm | pnpm self-update | bun upgrade | lpm self-update, based on the installation method. |
These targets do not imply equal support for every managed tool, sandbox, or infrastructure feature. See installation for LPM CLI requirements.
Source scope
The feature tables were checked against these source snapshots on September 20, 2026. Versions identify the repository manifests. Upstream branches can include changes newer than the corresponding release.
| Tool | Manifest version | Source revision |
|---|---|---|
| npm | 12.0.2 | 6400533 |
| pnpm | 12.5.1 | 070e3b2 |
| Bun | 1.4.3 | fc297d4 |
| LPM CLI | 0.78.0 | 2120105 |
Key sources: npm script policy, pnpm configuration, Bun script trust, and LPM CLI provenance scope.
The benchmark section has its own dated results and tool versions. Its timings do not describe the source snapshots in these feature tables.