pnpm & The Content-Addressable Store

pnpm (Performant npm) is a modern Node.js package manager designed for extreme speed and disk efficiency. Unlike npm or Yarn which copy full dependency trees into every project on your computer, pnpm maintains a single global Content-Addressable Store (CAS) located at ~/.local/share/pnpm/store/v3 or %LOCALAPPDATA%\pnpm\store\v3.

Every file from every package version is stored once in the global store indexed by its cryptographic hash. Projects then link to these stored files using operating system hard links inside a hidden virtual directory named node_modules/.pnpm.

Traditional package managers duplicate tens of thousands of identical files across multiple projects, wasting gigabytes of disk space and slowing down installations with heavy disk I/O.

Furthermore, flat hoisting in npm and Yarn v1 creates dangerous phantom dependencies where code can import packages not listed in package.json. pnpm solves both problems simultaneously: hard links provide 100% disk deduplication while strict symlink structures guarantee that projects can only import declared dependencies.

When running pnpm install, pnpm checks the global CAS store for each package file. If missing, it downloads and saves the file to the global store once. It then creates hard links (fs.link) from node_modules/.pnpm/<name>@<version>/node_modules/<name> pointing directly to the global store inodes.

To make packages accessible to Node.js resolution, pnpm creates symbolic links (fs.symlink) from your project's root node_modules/<name> pointing into .pnpm. For nested dependencies, symlinks inside .pnpm/<parent>@<version>/node_modules/ point to the child dependency folder. Node.js standard parent directory lookup works out of the box without runtime loaders or monkey patching.