
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
node-linux-armv7l
Advanced tools
Node.js is an open-source, cross-platform JavaScript runtime environment.
For information on using Node.js, see the Node.js website.
The Node.js project uses an open governance model. The OpenJS Foundation provides support for the project.
Contributors are expected to act in a collaborative manner to move the project forward. We encourage the constructive exchange of contrary opinions and compromise. The TSC reserves the right to limit or block contributors who repeatedly act in ways that discourage, exhaust, or otherwise negatively affect other participants.
This project has a Code of Conduct.
Looking for help? Check out the instructions for getting support.
Current and LTS releases follow semantic versioning. A member of the Release Team signs each Current and LTS release. For more information, see the Release README.
Binaries, installers, and source tarballs are available at https://nodejs.org/en/download/.
https://nodejs.org/download/release/
The latest directory is an alias for the latest Current release. The latest-codename directory is an alias for the latest release from an LTS line. For example, the latest-hydrogen directory contains the latest Hydrogen (Node.js 18) release.
https://nodejs.org/download/nightly/
Each directory and filename includes the version (e.g., v22.0.0),
followed by the UTC date (e.g., 20240424 for April 24, 2024),
and the short commit SHA of the HEAD of the release (e.g., ddd0a9e494).
For instance, a full directory name might look like v22.0.0-nightly20240424ddd0a9e494.
Documentation for the latest Current release is at https://nodejs.org/api/. Version-specific documentation is available in each release directory in the docs subdirectory. Version-specific documentation is also at https://nodejs.org/download/docs/.
Download directories contain a SHASUMS256.txt.asc file with SHA checksums for the
files and the releaser PGP signature.
You can get a trusted keyring from nodejs/release-keys, e.g. using curl:
curl -fsLo "/path/to/nodejs-keyring.kbx" "https://github.com/nodejs/release-keys/raw/HEAD/gpg/pubring.kbx"
Alternatively, you can import the releaser keys in your default keyring, see Release keys for commands to how to do that.
Then, you can verify the files you've downloaded locally
(if you're using your default keyring, pass --keyring="${GNUPGHOME:-~/.gnupg}/pubring.kbx"):
curl -fsO "https://nodejs.org/dist/${VERSION}/SHASUMS256.txt.asc" \
&& gpgv --keyring="/path/to/nodejs-keyring.kbx" --output SHASUMS256.txt < SHASUMS256.txt.asc \
&& shasum --check SHASUMS256.txt --ignore-missing
See BUILDING.md for instructions on how to build Node.js from source and a list of supported platforms.
For information on reporting security vulnerabilities in Node.js, see SECURITY.md.
For information about the governance of the Node.js project, see GOVERNANCE.md.
Collaborators follow the Collaborator Guide in maintaining the Node.js project.
Triagers follow the Triage Guide when responding to new issues.
Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
5BE8A3F6C8A5C01D106C0AD820B1A390B168D356DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7CC68F5A3106FF448322E48ED27F5E38D5B0A215F8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C108F52B48DB57BB0CC439B2997B01419BD92F80AA363A499291CBBC940DD62E41F10027AF002F8B0You can use the keyring the project maintains at https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx. Alternatively, you can import them from a public key server. Have in mind that the project cannot guarantee the availability of the server nor the keys on that server.
gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
gpg --keyserver hkps://keys.openpgp.org --recv-keys A363A499291CBBC940DD62E41F10027AF002F8B0 # Ulises Gascón
See Verifying binaries for how to use these keys to verify a downloaded file.
C0D6248439F1D5604AAFFB4021D900FFDB2337564ED778F539E3634C779C87C6D7062848A1AB005C141F07595B7B3FFE74309A937405533BE57C7D579554F04D7259F04124DE6B476D5A82AC7E37093B94AE36675C464D64BAFA68DD7434390BDBE9B9C51C050899334244A8AF75E53792EF661D867B9DFA
74F12602B6F1C4E913FAA37AD3A89613643B6201B9AE9905FFD7803F25714661B63B535A4C206CA977984A986EBC2AA786BC0F66B01FBB92821C587A93C7E9E91B49E432C2F75674B0A78B0A6C481CF656730D5401028683275BD23C23EFEFE93C4CFFFE71DCFD284A79C3B38668286BC97EC7A07EDE3FC1FD3A5288F042B6850C66B31F09FE44734EB7990E61FC681DFB92A079F1685E77973F295594EC4689114F43EE0176B71C7BC219DD50A3051F888C628DC4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8DD8F2338BAE7501E3DD5AC78C273792F7D83545DA48C2BEE680E841632CD4E44F07496B3EB3C1762B9E2F5981AA6E0CD28160D9FF13993A75599653C7937DFD2AB06298B2293C3187D33FF9D0246406DThe project maintains a keyring able to verify all past releases of Node.js at https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg/pubring.kbx.
When possible, the commitment to take slots in the security release steward rotation is made by companies in order to ensure individuals who act as security stewards have the support and recognition from their employer to be able to prioritize security releases. Security release stewards manage security releases on a rotation basis as outlined in the security release process.
Marco Ippolito
Marco Ippolito <marcoippolito54@gmail.com> (he/him)RafaelGSS
Rafael Gonzaga <rafael.nunu@hotmail.com> (he/him)mcollina
Matteo Collina <matteo.collina@gmail.com> (he/him)Node.js is licensed under the MIT License.
This project also depends on external libraries that may use different open-source licenses. For a complete list of included licenses, please see the LICENSE file.
If you are contributing documentation or source changes, please ensure your additions comply with the project’s license guidelines.
FAQs
node
The npm package node-linux-armv7l receives a total of 133 weekly downloads. As such, node-linux-armv7l popularity was classified as not popular.
We found that node-linux-armv7l demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.