Choosing a Build

This guide details the differences between NVM for Windows Community Builds and Certified Builds, to help readers choose the option best suited for them.

Type	Audience	License	Availability
Community Build	Individuals	MIT	nvm-windows.com or github.com/nvm-windows
Certified Build	Organizations	EULA	Customer portal

Community Builds

Community Builds are designed for individual developers. They contain the full application with all features. They do not contain capabilities for centralized management. These builds are released using an open source .exe installer. Published Community Builds are code-signed. The publisher is Author Software Inc.

Certified Builds

Certified Builds are designed for teams and organizations who need to centralize software distribution, audit activity, comply with regulations, & enforce usage/security policies. These builds deliver the same application while adding meaningful management capabilities. Distribution is through the Customer Portal.

Key additions

• Deployment-ready installers (Intune/MSI + Powershell Scripts)
• Financially-backed (Author Software Inc)

Additional capabilties are available as add-ons:

Add-on	Capabilities
Advanced Logging	Structured logging for SIEM integration.
Trust Artifacts	Signed Bill of Materials (SBOM), SLSA Attestations, SAST results, Open-source license report, and VEX Reporting.
Governance	Central policy management (ADMX/ADML + GPO/Entra scripts), advanced proxy support (IWA, WPAD/PAC), Node.js mirror (mirror.author.io), version firewall, shim-enforced Node.js permissions, force the package-manager cooldown from machine policy (npm/pnpm/yarn/vlt/bun), and air-gap/local installations.

Code Signing Authority

NVM for Windows is distributed by Author Software Inc. Our EV code signing certificates are issued directly by Microsoft.

Stewardship Transition

Early versions of NVM for Windows v1 were code-signed by Ecor Ventures LLC using certificates issued by Sectigo. In January 2025, project stewardship was transitioned to Author Software Inc.

This transition was authorized by Corey Butler, the creator of NVM for Windows. He is the founder & Managing Director of Ecor Ventures LLC and the co-founder of Author Software Inc.

Auditing & Observability

Both editions have native Windows Application logging with plaintext log entries using generic event codes. While these can be consumed by log aggregators, they are designed for developer reference, not auditing/observability.

The Advanced Logging package for Certified Builds introduce comprehensive structured logging with a dedicated native log. Log entries are specifically designed for direct export to central SIEM systems.

Structured logs allow SIEM systems to capture and query events with far greater precision and predictability. For example, an SIEM query can quickly identify which versions of Node.js are still regularly used by developers/agents in your organization, when unsupported/EOL versions are installed or finally uninstalled, or which npm modules are installed most often.

Trust Artifacts

The Trust Artifacts add-on provides a compliance pack with each certified release (SBOM, SLSA provenance, license inventory, SAST, and a verifier). Customers download it from the customer portal. The portal can also deliver the same pack to the customer's auditors. This add-on is not a separate product tier named Compliance.

Artifact	What it is
Signed Bill of Materials (SBOM)	CycloneDX component and rollup SBOMs (`node`, `proxy`, `reshim`, `nvm`, `sync`, `nvm-windows`), signed when the release signing step runs.
SLSA Attestations	Offline-verifiable DSSE / in-toto provenance for the certified app pack (SLSA Build L3).
SAST results	SARIF 2.1.0 from gosec (Go) and PSScriptAnalyzer (PowerShell). Not a penetration test; no CodeQL or DAST.
Open-source license report	Markdown summary and CSV inventory derived from the rollup SBOM. Rows marked `unknown` need review.
VEX Reporting	Vulnerability exploitability statements when required for the release.

See Trust Artifacts for pack layout, portal delivery, and how to review.

Policy Management

The Governance package for Certified Builds introduce policy management. With these capabilities, it is possible to enforce security policies. For example:

• Utilize corporate proxies (IWA, PAC/WPAD).
• Block unapproved Node.js versions with static allow and block lists (semver, wildcards).
• Force npm/npx/yarn/pnpm/vlt/bun cooldown periods from machine policy.
• Enforce Node.js permission model (--permission / --experimental-permission) so shimmed node starts default-deny; npm/npx/pnpm lifecycle scripts inherit the same flags via npm_config_node_options when the policy is on. Apps must pass --allow-* at runtime.
• Freeze V8 intrinsics (--frozen-intrinsics) to prevent prototype pollution of built-ins (also applied to npm/npx/pnpm scripts when the policy is on).
• Disallow eval() / new Function() (--disallow-code-generation-from-strings) (also applied to npm/npx/pnpm scripts when the policy is on).
• Limit to local installations (airgapping).
• Restrict version installations with the version firewall. Lifecycle aliases such as EOL and ALPHA apply on the Author Mirror, not the client.

Governance builds ship with ADMX/ADML files and official scripts to support Microsoft Active Directory group policies, Microsoft Entra, and other device management platforms.

Policy-Enforced Node.js Mirror

Certified governance builds include access to Author Software's Node.js mirror/proxy. This service provides policy enforcement at the mirror level, for restricting which Node.js versions can be downloaded by users.

The mirror is only accessible through NVM for Windows, allowing organizations to block nodejs.org/dist while granting gated access to approved versions.

Enterprise Agreements

Certified custom builds do not provide additional technical capabilites beyond those in the governenace build. Custom agreements are for organizations that need EULA redlining, additional compliance documentation, additional named insured, invoicing, onboarding support, and/or other services. For more information, contact [email protected].