Evolution and Innovations of npm, Yarn, and pnpm Package Managers

Introduction

Node.js ships with npm, while Corepack includes Yarn and pnpm. The article focuses on these three tools, exploring their innovative features and how they solved emerging problems.

npm

Nested Dependency Structure

Early npm versions created deeply nested node_modules directories, leading to duplicate installations and path‑length issues on Windows.

Flattening (npm v3)

npm v3 introduced a hoist mechanism that moves shared dependencies to the top level, reducing duplication but still facing challenges with multiple versions.

New Issues

Flattening caused phantom dependencies, doppelgangers, and non‑idempotent installs, especially when installation order varied.

Lock Files

npm‑shrinkwrap.json (manual) and later package-lock.json (auto‑generated) ensure reproducible installs and integrity verification using SRI hashes.

Yarn

Yarn 0.x appeared before npm v4, adopting npm’s flattening while adding parallel installs, caching, and offline mode.

Workspaces

Yarn workspaces hoist shared dependencies to the project root, simplifying monorepo management.

Lock File

Yarn automatically generates yarn.lock , a feature later adopted by npm v5.

pnpm

Symbol Link

pnpm stores packages in a global store and creates symlinks in node_modules , eliminating phantom dependencies.

Hard Link

Files are hard‑linked from the store, allowing multiple projects to share the same physical files and saving disk space.

Yarn Berry (v2+)

PnP Mode

Yarn Berry removes node_modules entirely, using a .pnp.cjs file to map dependencies and monkey‑patch Node’s resolver, solving doppelgangers and phantom dependencies while improving install speed.

Plugin System

Yarn Berry supports plugins (e.g., @yarnpkg/plugin-typescript ) to extend functionality such as automatic @types installation.

Conclusion

The three package managers continuously learn from each other, introducing features like npx/dlx commands, PnP support, and optional dependencies, driving the JavaScript ecosystem forward.