
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Python venv-like Node.js environment manager - project-local Node.js installation without global environment pollution
Python venv-like Node.js environment manager - Create project-local Node.js installations without global environment pollution.
nvenv is a Node.js environment management tool inspired by Python's venv. It follows the Gradle philosophy of project-local installations, ensuring that each project has its own isolated Node.js environment without polluting the global system.
activate/deactivate workflowUnlike tools like nvm, asdf, or mise that manage Node.js versions globally, nvenv takes a Gradle-like approach where each project has its own local Node.js installation. This eliminates version conflicts between projects and ensures complete environment isolation.
No installation required! Use directly with npx:
npx nvenv --node=18.20.0 venv
Or install globally if you prefer:
npm install -g nvenv
nvenv --node=18.20.0 venv
Create a new Node.js environment with a specific version:
npx nvenv --node=18.20.0 venv
This will:
venv/lib/venv/bin/Bash/Zsh:
source venv/bin/activate
Fish:
source venv/bin/activate.fish
After activation, your shell prompt will show (nvenv) prefix, and node, npm, and npx commands will use the local installation.
Once activated, use Node.js and npm as usual:
(nvenv) $ node --version
v18.20.0
(nvenv) $ npm install express
(nvenv) $ node app.js
To return to your system's Node.js:
(nvenv) $ deactivate
After creating an environment, you'll have:
venv/
├── .nvenv # Metadata (version, platform, arch)
├── bin/
│ ├── activate # Bash/Zsh activation script
│ ├── activate.fish # Fish activation script
│ ├── node # Symlink to Node.js binary
│ ├── npm # Symlink to npm
│ └── npx # Symlink to npx
└── lib/
└── node-v18.20.0/ # Full Node.js installation
# Node.js 18.x
npx nvenv --node=18.20.0 venv
# Node.js 20.x
npx nvenv --node=20.11.0 my-project
# Latest LTS
npx nvenv --node=20.18.0 production
# GitHub Actions example
- name: Create Node.js environment
run: npx nvenv --node=18.20.0 venv
- name: Install dependencies
run: |
source venv/bin/activate
npm install
npm test
# Project A uses Node.js 16
cd project-a
npx nvenv --node=16.20.0 venv
source venv/bin/activate
npm install
# Project B uses Node.js 20
cd ../project-b
npx nvenv --node=20.11.0 venv
source venv/bin/activate
npm install
nvenv can be configured using environment variables:
NVENV_SILENT: Set to 1 to suppress progress output during environment creationNVENV_MIRROR: Custom mirror URL for Node.js downloads (default: https://nodejs.org/dist)For faster downloads in certain regions, you can use a mirror:
# China mirror (npmmirror/Taobao)
export NVENV_MIRROR=https://npmmirror.com/mirrors/node
npx nvenv --node=18.20.0 venv
# Or set for a single command
NVENV_MIRROR=https://npmmirror.com/mirrors/node npx nvenv --node=18.20.0 venv
Popular mirrors:
https://npmmirror.com/mirrors/nodehttps://mirrors.cloud.tencent.com/nodejs-releaseSuppress verbose download progress output:
# Silent mode for CI/CD
NVENV_SILENT=1 npx nvenv --node=18.20.0 venv
# Or use the --silent flag
npx nvenv --silent --node=18.20.0 venv
| Feature | nvenv | nvm | asdf | mise | volta |
|---|---|---|---|---|---|
| Project-local | ✓ | ✗ | ✗ | ✗ | ✗ |
| No global state | ✓ | ✗ | ✗ | ✗ | ✗ |
| Zero config | ✓ | ✗ | ✗ | ✗ | ✗ |
| npx-ready | ✓ | ✗ | ✗ | ✗ | ✗ |
| Python venv-like | ✓ | ✗ | ✗ | ✗ | ✗ |
Traditional Node.js version managers like nvm or asdf manage versions globally and share them across projects. This can lead to:
node_modules affecting multiple projectsnvenv solves these by giving each project its own isolated Node.js installation, similar to how Gradle downloads dependencies per-project or how Python's venv creates isolated Python environments.
# Clone the repository
git clone https://github.com/yourusername/nvenv.git
cd nvenv
# Test locally
node src/cli.js --node=18.20.0 test-env
# Activate test environment
source test-env/bin/activate
No. Add it to .gitignore:
venv/
Users should create their own environment using npx nvenv.
Yes! Just create a new environment in your project directory:
cd my-existing-project
npx nvenv --node=18.20.0 venv
source venv/bin/activate
npm install
Approximately 40-60MB per environment, depending on the Node.js version and platform. This is the trade-off for complete isolation.
MIT
venv - Virtual environment conceptContributions welcome! Please open an issue or PR on GitHub.
Created as a weekend project inspired by the desire for Gradle-like Node.js environment management.
FAQs
Python venv-like Node.js environment manager - project-local Node.js installation without global environment pollution
We found that nvenv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.