jpm

jpm is a fast, small, and secure-by-default package manager for JavaScript that installs npm packages from a 2 MB binary with dependency management.

jpm is a fast, small, and secure-by-default JavaScript package manager packaged as a single 2 MB binary. It functions as a drop-in replacement for npm, pnpm, yarn, and bun, importing existing lockfiles into its own jpm.lock format to maintain consistent versions. The tool uses a content-addressed store where each file is stored once by hash and hardlinked to project directories, significantly reducing storage and installation time. Security features include holding new package versions back by default, requiring manual approval for install scripts, and checking runtimes against known signatures. It supports workspaces, overrides, and resolutions, and maintains CI compatibility by allowing the use of old lockfiles until a switch is complete.

jpm at a glance

Best for: Software engineer
Runs on: Linux, macOS, Windows
Pricing: Free
Released: October 2026
Category: AI coding tool
Website: getjpm.sh

Key features

Single 2 MB binary without external runtime requirements
Content-addressed store for efficient file reuse
Security checks for install scripts requiring user approval
Automatic delay of new package version adoption
Compatibility with npm, pnpm, yarn, and bun lockfiles
Hardlinking dependencies to minimize disk usage
Built-in TLS implementation for secure registry communication

Use it for

Managing JavaScript project dependencies in CI pipelines
Migrating existing projects from npm, pnpm, yarn, or bun
Installing package dependencies with default security restrictions
Developing applications requiring minimal storage overhead

Alternatives to jpm

jevgrep — Reduces coding agent costs by providing targeted, relevant repository context.
APM — Standardize and reproduce AI agent configurations with dependency management.
sem — Performs entity-level diffs instead of line-based changes.
DeployRamp — Automates feature flag wrapping, rollout monitoring, and cleanup for code.
unpkg.ai — Generates JavaScript modules on demand via API with no signup or keys required.
jcode — Optimized for massive parallelism with low memory usage per session.
LangChain4j — Integrates LLMs and vector stores directly into Java applications.
Personal Context Manager — Manages global and project-specific coding rules in a Git repository.
OpenCode — Works with 75+ model providers, local models, and existing subscriptions
jscpd — A native Rust binary that runs fast without a Node.js runtime and integrates with AI agents.
LMDeploy — Accelerates inference with high-performance engines and quantization tools.
Ccm — Measures codebases, traces change impact, and estimates resource costs locally.

All jpm alternatives