📦 Install Node Power User

First, install the package via npm:

npm i -g node-power-user

🦄 Features

• Clean and reinstall your node project
• Easily bump your NPM project's version without opening an editor

📘 Example Setup

After installing via NPM, you can use the CLI with the npu command.

💻 Example CLI Usage

Bump Version

Bump your project's version by the specified level.

npu bump <level>

• npu bump patch: Bump the last number
• npu bump minor: Bump the middle number
• npu bump major: Bump the first number

Clean Project

Clean your node project (runs rm -fr node_modules && rm -fr package-lock.json && npm cache clean --force && npm install && npm rb).

npu clean

Global Packages

List all global packages for all versions of Node.js on your machine (you must have NVM installed).

npu global

Install Packages

Install packages with supply chain protection via Socket Firewall (sfw). Every install is wrapped with sfw, which blocks malicious or compromised packages — including transitive dependencies — before they're downloaded.

npu install
npu i <package>
npu i <package> --save-dev --legacy-peer-deps

Every npm flag passes through verbatim (--save-dev, --save-exact, --legacy-peer-deps, --dry-run, ...) — npu doesn't maintain a whitelist.

If Socket Firewall is not installed, npu install will refuse to run. Install it globally to enable protection:

npm install -g sfw

Use --force (before the command) to bypass Socket protection (not recommended):

npu --force i <package>

Run Packages (npx)

Run a package binary with supply chain protection. When the binary would be downloaded from npm, the run is wrapped with Socket Firewall. When it's already installed locally (node_modules/.bin/), it runs directly — nothing is downloaded, so there's nothing to protect and no firewall overhead.

npu npx <command> [args...]

• Output streams live in both modes.
• The child command's exit code is propagated (CI-safe).
• Everything after the command passes through to the child — e.g. npu npx rimraf dist --force sends --force to rimraf.
• npu's own flags go before the npx token:

npu --force npx <command>   # bypass Socket protection (not recommended)

A run is only reported as blocked when Socket Firewall actually blocked a download — an ordinary failure (like a failing test suite) is reported as a plain command failure with its exit code.

Two edge behaviors: --package/-p runs always stay behind the firewall (they download regardless of local binaries), and bare flag queries (npx --version, npx --help) pass through silently with no wrapper output at all.

Wrapped npm (exec / create / init)

Run any npm command wrapped with Socket Firewall, args untouched. This is what the shell shims use to protect npm exec|create|init without rewriting their semantics — npm create X maps to package create-X, so it must never be turned into npx X.

npu npm <args...>
npu npm create vite my-app
npu --force npm <args...>   # bypass Socket protection (not recommended)

Audit

Run a Socket supply chain audit on your current dependency tree.

npu audit

Outdated Packages

Compare the versions of installed modules to those in your package.json. When you choose to update, the install step and a full post-install audit are both wrapped with Socket for supply chain protection.

npu outdated
npu out --heal        # skip the menu: reinstall copies that don't match package-lock.json
npu out --sync        # skip the menu: install packages to match package.json
npu out -r            # skip the menu: reconcile package.json to installed versions
npu out -P | -m | -M  # skip the menu: apply patch / minor / major updates
npu out --min-age 14  # only update packages published ≥ 14 days ago (default: 7)
npu out --min-age 0   # disable age filtering — update everything
npu out --force       # bypass Socket protection

The table includes a Released column showing when each package's latest version was published and how many days ago. Packages published less than --min-age days ago (default: 7) are flagged with ⚠ and automatically skipped during updates — unless that version is already installed. This protects against supply chain attacks that target brand-new releases.

Every run starts with an integrity check: npu compares what node_modules/.package-lock.json claims is installed against the packages physically on disk — including transitive deps the table can't show. Desynced copies (stale or partially-extracted installs, typically left behind by an interrupted or Socket-blocked install) make npm silently no-op (npm install trusts the lockfile over the disk), so npu warns about them and offers to heal.

When problems are found, the menu offers context-aware actions:

• Heal — when disk copies don't match package-lock.json, removes them and reinstalls so reality matches the lockfile again.
• Sync — when node_modules is behind package.json, installs packages to match what package.json declares.
• Reconcile — when node_modules is ahead of package.json, updates package.json to match installed versions. Strictly ahead-only — it never downgrades package.json to match a stale install.

Installs remove the targeted node_modules copies first so npm actually re-fetches them (instead of trusting a stale lockfile and reporting "up to date"), then npu verifies the new versions physically landed in node_modules. If an install fails or Socket blocks it, both package.json and package-lock.json are restored — npu never leaves the lockfile advanced past the files on disk.

List Packages

List all packages in your project.

npu packages

Sync Changes

Pull the latest changes from the remote repository and push your changes. You can optionally supply a --message="Your commit message here" flag.

npu sync

Open Repository

Open the current repository's remote URL in your default browser.

npu open

Check Version

Check the version of node-power-user.

npu -v

Wait

Wait for a specified number of ms.

npu wait <ms>

Global flags

• -C <dir>, --cwd <dir>: Run as if invoked from <dir> (e.g. npu -C /path/to/project out)
• --debug: Log the commands and flags before they are executed

🛠️ Development

To test commands locally while developing:

npm start -- <command> [options]

For example:

npm start -- outdated
npm start -- bump patch
npm start -- -v

🗨️ Final Words

If you are still having difficulty, we would love for you to post a question to the Node Power User issues page. It is much easier to answer questions that include your code and relevant files! So if you can provide them, we'd be extremely grateful (and more likely to help you find the answer!)

📚 Projects Using this Library

Somiibo: A Social Media Bot with an open-source module library. JekyllUp: A website devoted to sharing the best Jekyll themes. Slapform: A backend processor for your HTML forms on static sites. Proxifly: A backend processor for your HTML forms on static sites. Optiic: A backend processor for your HTML forms on static sites. SoundGrail Music App: A resource for producers, musicians, and DJs. Hammock Report: An API for exploring and listing backyard products.

Ask us to have your project listed! :)