Corepack is a tool that runs the package manager your project names in the packageManager field of package.json, so every developer and CI job uses the same npm, Yarn or pnpm version. Adding a hash to that field makes Corepack verify what it downloads. It no longer ships inside Node.js from version 25.
What the packageManager field does
Package managers differ in how they resolve versions, read lockfiles and treat install scripts. If two people on a team run different versions, they can produce different lockfiles from the same package.json. That is a reliability problem first and a security problem second, because a lockfile you cannot reproduce is a lockfile you cannot review with confidence.
The Corepack project describes the field as the place to declare your package manager. The value is a name, a version and an optional hash, for example a Yarn version followed by a plus sign and a sha224 digest. The permitted names are yarn, npm and pnpm.
Why the hash matters
Without a hash, Corepack fetches a package manager release and trusts what arrives. The project says the hash is optional but strongly recommended as a security practice. It also provides an environment variable, COREPACK_ON_UNVERIFIED_DOWNLOAD, that controls what happens when a download has no hash, from a warning up to a hard failure.
Think of it as lockfile integrity for your tooling. The tool that installs everything else deserves the same pinning you give your dependencies.
The Node 25 change
The Corepack README states that it is distributed with Node.js from 14.19.0 up to, but not including, 25.0.0. On Node 25 and later you install Corepack yourself from npm if you want it. If your CI images or onboarding docs say "Corepack is already there", check them against the Node version you actually run.
A short setup
- Decide which package manager and version the project uses.
- Add the packageManager field with that version, and a hash if your tooling can produce one.
- Enable Corepack in CI and on developer machines, installing it first on Node 25 or later.
- Set the unverified download variable to fail in CI once hashes are in place.
- Update the pinned version on purpose, in its own pull request, like any other dependency bump.
| Approach | Reproducible across machines | Verifies the download |
|---|---|---|
| Whatever is installed globally | No | No |
| packageManager with version only | Yes | Weaker |
| packageManager with version and hash | Yes | Yes |
Try it yourself
Click through it at your own pace, or open it full screen.
Open a component in the inventory and note how the exact version and source are recorded. Your package manager deserves the same precision.
Quick check
Is Corepack still included with Node.js?
According to the Corepack README, it ships with Node.js from 14.19.0 up to but not including 25.0.0. For Node 25 and later you install it separately.
Is the hash in packageManager required?
No. It is optional, but the project strongly recommends it as a security practice.
Safeguard reads lockfiles to build an SBOM and dependency inventory, and you can try it on a repository with the free scan at gold.safeguard.sh/scan. For lockfile habits, see what a lockfile is and why to commit it.
Sources
Last reviewed: 19 October 2026.
