What is Yarn?Facebook developed Yarn in 2016 as a replacement for NPM. It was designed to offer more advanced features that NPM lacked at the time (such as version locking) and create a more secure, stable, and efficient product.However, since Yarn was released, NPM has added several crucial features. In its current state, Yarn is now more of an alternative to NPM rather than a replacement.
What is NPM?NPM is the default package manager for Node.js with a CLI tool that helps install, manage, and remove Node.js packages. It also enables users to share open-source Node.js packages.
Yarn vs. NPM: ComparisonBelow is an outline of some of the similarities and differences between Yarn and NPM.
InstallationWe will start by comparing the installation process for Yarn and NPM:YarnTo start using Yarn, you need to install it using the MSI installer from the official website or a package manager such as Chocolatey, Scoop CLI, or NPM itself. Learn more in our guide to installing Yarn on Windows and installing Yarn on Ubuntu 18.04.NPMNPM is included by default with the Node.js installation and doesn't require any additional steps to install. To learn more about installing Node.js and NPM, have a look at one of our guides:
- How To Install Node.js & NPM on Ubuntu 18.04 and 20.04
- How to Install Node.js and NPM on CentOS 7
- How to Install Node.js and NPM on Windows
- How to Install Node.js and NPM on Mac
DependenciesYarnYarn version 1 and NPM both manage dependencies in a very similar way. They both store project metadata in the package.json file, located in the node_modules folder inside the project directory.Starting from version 2, Yarn no longer uses the node_modules folder to track dependencies. Instead, Yarn 2.0 uses the Plug'n'Play feature, which generates a single .pnp.cjs file. This file contains a map of the dependency hierarchy for a project.Yarn uses the
yarncommand to install dependencies. It installs dependencies in parallel, allowing you to add multiple files at the same time.Installing dependencies automatically creates a lock file that saves the exact list of dependencies used for the project. With Yarn, this file is called yarn.lock.NPMNPM installs dependencies using the
npm installcommand. The dependencies are installed sequentially, one after another.NPM also creates a version lock file named package-lock.json. Yarn also supports package-lock.json files, allowing users to migrate version data from NPM to Yarn.
Speed and PerformanceAs mentioned above, while NPM installs dependency packages sequentially, Yarn installs in-parallel. Because of this, Yarn performs faster than NPM when installing larger files.Both tools also offer the option of saving dependency files in the offline cache. This allows users to install dependencies even if they are offline.In addition, starting from version 2, Yarn uses the Zero install feature. This feature takes the dependency map from the .pnp.cjs file and uses it to perform an offline dependency install with virtually zero delays.
SecurityYarnYarn performs a security check as a background process while downloading packages. It uses the package license information to ensure it doesn't download any malicious scripts or cause any dependency conflicts.Both tools use encryption protocols to ensure safe data transfer. Yarn verifies packages with checksum, while NPM uses SHA-512 (Secure Hash Algorithm) stored in the package-lock.json file.NPMSecurity threats were a significant issue in early versions of NPM. As of version 6, NPM performs a security audit every time you install a package. This helps prevent vulnerabilities and ensures there aren't any conflicting dependencies.You can also run a manual audit by using the
npm auditcommand. If NPM finds any vulnerabilities, using
npm audit fixshould resolve the issues.
Ease of UseBoth Yarn and NPM are relatively easy to use, especially considering they share several commands. The command output is generally easy to read and understand, though it can become less visually distinguishable when installing a large number of packages.Both package managers offer an interactive mode that helps users set up new projects. In Yarn, this mode is enabled by default, while NPM requires the npm-upgrade package to enable interactivity.
FeaturesYarn and NPM have several key features in common:
- Generating lock files: Both package managers automatically create a version lock file. With Yarn, this file is called yarn.lock, while NPM names the file package-lock.json.
- Using workspaces: Both Yarn and NPM support workspaces, allowing you to use a single repository to manage dependencies for multiple projects.
- Remote scripts: Both NPM and Yarn allow you to run scripts remotely, using the
npxcommand in NPM and the
yarn dlxcommand in Yarn.
- Plug'n'Play: Instead of using the node_modules folder, Yarn generates a single .pnp.cjs file that maps project dependencies. This allows for more optimized dependency trees and faster project startup and package installation.
- Zero installs: This feature ties in with Plug'n'Play, using the .pnp.cjs file to map packages stored in the offline cache. This allows you to access and install stored packages with almost no delay.
- License check: Yarn features a built-in license checker when downloading and installing packages.
CommandsThe table below provides an overview of some of the most frequently used commands for NPM and Yarn:
|Initialize a project|
|Run tests for the current package|
|Check for outdated packages|
|Publish a package|
|Run a script|
|Manage local package cache|
|Log in or out|
|Install packages globally|
|Uninstall packages globally|
|Interactive dependency update|
|Run package remotely|
Yarn vs. NPM: How to ChooseIt's essential to consider the advantages and disadvantages of both NPM and Yarn when deciding which one to use.
- Supports parallel installation and Zero installs, both of which dramatically increase performance.
- Newer versions of Yarn offer a more secure form of version locking.
- Active user community.
- Yarn doesn't work with Node.js versions older than version 5.
- Yarn has shown problems when trying to install native modules.
- Easy to use, especially for developers used to the workflow of older versions.
- Local package installation is optimized to save hard drive space.
- The simple UI helps reduce development time.
- The online NPM registry can become unreliable in case of performance issues. This also means that NPM requires network access to install packages from the registry.
- Despite a series of improvements across different versions, there are still security vulnerabilities when installing packages.
- Command output can be difficult to read.
VerdictConsidering all of the above, NPM is better for developers that are used to it and satisfied with its current workflow. It provides a reasonably efficient user experience while also saving hard drive space.On the other hand, Yarn offers more advanced features, such as Plug'n'Play and Zero installs. It also provides slightly better performance and security but at the cost of hard drive space.