Understanding Security

Version managers historically bypassed permissions, installed executable files wherever they want, and automated processes opaquely. These are exploitable attack surfaces, yet the fluidity afforded by these open operations provides a simple workflow developers love. Developers don't inherently wish to be insecure, but the nuances of managing Node.js securely often impact productivity to unacceptable levels. Developers are faced with a difficult choice to be secure or be productive.

NVM for Windows was designed to provide security and productivity. It aims to retain / expand the modern workflow developers crave while working within the protective boundaries of the OS instead of around them.

This guide summarizes how this is achieved, explains what is checked, when, and which edition owns which control.

Downloading Node.js

NVM for Windows v2 treats Node.js as an untrusted download until it passes integrity checks. Once these checks complete successfully, the version becomes available for use.

NVM for Windows also provides several mechanisms to prevent unapproved version installations, such as blocking end-of-life or unpatched versions.

Local Version Firewall

NVM for Windows can be configured to honor version allow/block-lists. These may contain specific versions or ranges. Version downloads (including cached/local) can be blocked with the firewall.

⭐ Learn more about the version firewall

Node.js Gateway / Mirror

Author Software provides a hosted Node.js download mirror. It contains a customizable gateway to restrict downloads by version, version maintainability (EOL), user, domain, and other optional criteria.

The mirror can be used in combination with proxies to force Node.js downloads through this gateway, providing organizations the ability to allow Node.js downloads in accordance to their own policies.

⭐ Learn more about the gateway / mirror

Installing Node.js versions

NVM for Windows installs Node.js versions to the configured storage location. It also manages the directory and file permissions automatically. For example, directory write permissions are restricted, preventing node.exe and global node modules from being overwritten by an unapproved file masquerading as an official executable.

Additionally, each Node.js version is registered with the operating system (see Windows Apps: Added Cybersecurity Value). This provides scanners a baseline of which versions are intentionally installed (approved), making it much simpler to identify unapproved node.exe files that may be present on a compromised computer.

Using the node command

Using package managers

Using global modules

Enforcing policies in a team / organization

Auditing & Observability

SIEM, registered app (intentionality), notifications as telemetry

Security model at a glance

In shim mode, NVM for Windows verifies the binary on every launch. Certified and Governance editions add machine policy, version firewalls, and (optionally) an Author-hosted download mirror/gateway.

important

Link mode does not provide additional security verifications.

Security model at a glance

Edition keys

Control	Community	Certified	Governance add-on
Archive SHASUM + node.exe Authenticode	✓	✓	✓
Allowed publisher org / thumbprint pins	✓	✓	✓
Version-directory DACL hardening	✓	✓	✓
Shim verify-cache + per-launch trust	shim mode	shim mode	shim mode
HKLM policy override (ADMX)	—	—	✓ (+ ADMX pack)
Version allow/block firewall	—	—	✓
Package-manager cooldown	—	—	✓
Force --permission / V8 lockdown	—	—	✓
Author mirror + hosted rules	—	—	✓

Shim-mode security features do not apply in link mode. Prefer shim mode for managed fleets.

1. Install-time verification

When nvm install (or auto-install) fetches a Node.js build:

1. Version firewall (Governance) — VersionAllowList / VersionBlockList in the Policies hive can refuse the version before download, at nvm use, and at shim launch. Without Governance those lists are ignored. See Version Firewall + Author Mirror.
2. Archive integrity — the .7z (or staged archive) is checked against the published SHASUMS256 file for that version/arch.
3. Authenticode on node.exe — after extract, Windows trust verification runs on the binary. A valid signature alone is not enough: the signer organization must be on the allow list.
4. Default trusted organizations — OpenJS Foundation, Node.js Foundation, and Author Software Inc. are always trusted. Add others (for example NodeSource) with AllowedSigners. Optional AllowedThumbprints pin specific certificate leafs.
5. DACL hardening — the version install directory is locked so other user accounts cannot rewrite node.exe (or swap a trojan into that tree). A compromised account that already owns the profile can still attack its own files; the control targets cross-account and remote write abuse.
6. Verify-cache seed — a signed cache entry is written so later shim launches can skip full Authenticode on the hot path.

Revocation behavior is configurable (AuthenticodeRevocation; air-gapped installs prefer cached checks). See Registry Policy Reference.

2. Runtime verification (shims)

v2’s primary runtime shims are:

Binary	Role
.shim\node.exe	Resolves version, verifies trust, applies optional security flags, spawns real Node
utils\proxy.exe	Same trust path for npm / npx / yarn / pnpm / bun (when shim_bun is on) and global module CLIs

(reshim.exe is a helper, not a day-to-day command shim.)

On every launch the shim:

1. Resolves which Node.js version to run (version resolution).
2. Self-checks when invoked from the data-root .shim tree — byte-compares against the canonical Program Files / install payload (integrity of the shim itself, not a second Authenticode round-trip).
3. Trusts node.exe — prefer a verify-cache hit (~1–2 ms). On miss or cache invalidation, run full Authenticode against allowed signers, then compare PE FileVersion to the folder version. Authenticode failure blocks with NVM4301. FileVersion mismatch (for example Node 10 in a v24.0.0 folder) blocks with NVM4314. Certified version-firewall denies use NVM4411.
4. Optionally prepends Governance security flags (below), then CreateProcessW the real Node.js.

Details: node (shim), Package Manager Shims.

3. Package managers and modules

Through proxy.exe, NVM can apply Governance package-manager controls such as NpmModuleMinimumAge (cooldown / minimum publish age for npm, npx, pnpm, yarn, vlt, and bun/bunx when shim_bun is on). Community defaults to off (0), matching stock npm/npx with no version manager. Certified Builds default to 2 days (2880 minutes) when the key is unset, including npx, vlt, and shimmed bun. HKLM Policies forces the value and strips CLI age-override flags.

Governance enforces the NVM Firewall module allow lists (ApprovedModules / ApprovedGlobalModules) from the Policies hive on shimmed installs. Without Governance those Policies lists are ignored (preference lists can still apply). Both editions support the trust firewall (TrustedModules) so approved self-updating global CLIs can auto-reshim after they rewrite their entrypoints.

Supply-chain risk inside transitive node_modules remains largely an upstream registry problem; Author Software’s longer-term Runtime / advanced security work addresses deeper checks separately. What NVM gates today:

• Node.js versions — local firewall + optional Author mirror rules (author-mirror)
• Publisher trust on node.exe every launch
• Cooldown on package-manager installs (Governance)
• Package allow lists (Governance module firewall) and self-update trust (trust firewall) — see Firewall

4. Node permission and V8 lockdown (Governance, shim mode)

Most teams never pass Node’s permission model flags. Governance policy can force them on shimmed node and, when at least one of these keys is on, on npm/npx/pnpm lifecycle scripts. Default off does not write npm_config_node_options. Yarn, bun, corepack, and vlt are not covered. NVM does not set NODE_OPTIONS.

Policy	Effect
EnforcePermissionModel	Prepend --permission (Node 23+) or --experimental-permission (20–22) on node. Default-deny FS/network until the process passes --allow-*. NVM does not inject grants except DefaultPermissionGrants. HKLM Policies strips --permission-audit (report-only) from argv, NODE_OPTIONS, and npm_config_node_options, then still injects --permission. Preference-only enforce leaves --permission-audit as a debug exception on node. Proxy merges the same flags into npm_config_node_options for npm/npx/pnpm. NVM never injects --permission-audit.
FreezeV8GlobalObjects	Prepend --frozen-intrinsics on node; same flag in npm_config_node_options for npm/npx/pnpm when on
DisableEvalAndStringExecution	Prepend --disallow-code-generation-from-strings (blocks eval / new Function; does not cover node:vm). Same flag in npm_config_node_options for npm/npx/pnpm when on

See Operating Modes and registry keys.

5. Registry and enterprise policy

Settings live in the Windows registry. Broadly:

• User preferences (HKCU) — what an interactive user can change without admin rights.
• Machine preferences (HKLM Preferences) — what administrators write under the Preferences hive. Available without Governance.
• Machine policy (HKLM Policies) — what GPO/MDM write under Software\Policies. Honored only with a Governance license (AllowsMachinePolicy).

The Governance pack ships ADMX/ADML templates for Active Directory and Entra/Intune-style configuration. Different GPOs can set different risk postures (for example block EOL Node for most users, allow one legacy version for a migration team). See Administrative Templates and Registry Policy Reference.

6. Author download mirror (Governance)

Organizations can deny public nodejs.org/dist at the network edge and allow-list mirror.author.io. NVM then downloads through Author’s policy-aware mirror. Controls combine:

• Client/GPO lists (VersionAllowList / VersionBlockList) for exact versions and ranges — lifecycle aliases such as EOL / ALPHA / MAINTENANCE are ignored on the client and only applied by the Author Mirror at download
• Hosted rules in the customer portal (IP, geo, domain/tenant, SID, license group)

Walkthrough: Version Firewall + Author Mirror. Domain/tenant IDs: Find Your AD Domain or Entra Tenant ID.

7. Auditing and native integrations

Critical install, config, and security events go to Windows Event Viewer on Community and Certified builds. Optional Advanced Logging (Certified add-on) targets SIEM-friendly structured codes. Per-invocation logging is available via LogExecutions in shim mode.

See Event Logging. Broader product context (including native integrations): Why we rewrote NVM for Windows (external).

Related

Topic	Doc
Shim behavior	node (shim)
npm / yarn / pnpm / bun shims	Package Manager Shims
Shim vs link	Operating Modes
Policy keys	Registry Policy Reference
Version firewall / mirror	Author Mirror
Editions	Choosing an Edition
Error codes (NVM43xx / NVM44xx)	Error Codes