Safeguard
Developer Tools•

How do you update npm itself, and why does Windows keep the old one?

Run npm install -g npm@latest to update npm. On Windows the Node installer copy can take priority on PATH, so you may see no change. Fixes and checks.

Safeguard Security Team
4 min read

Check your version with npm -v, then update with npm install -g npm@latest. On Windows you may still see the old version afterward, because the npm installed with Node.js can take priority on your PATH. Fix the PATH order, or remove the bundled copy, and confirm with npm -v again.

The basic update

The npm documentation gives these steps. Check the current version:

npm -v

On macOS, Linux and other Unix-like systems, update with:

npm install -g npm@latest

The page notes you may need sudo, especially on Linux, or on macOS if you installed Node using its default installer. Prefer fixing the install location over using sudo for global installs where you can, because running installs as root widens what a package script could touch.

Why Windows behaves differently

The docs explain that the Node installer puts its own npm in the Program Files nodejs folder, and that copy takes priority on PATH. The page says it will always use the npm installed with Node instead of the version you installed.

You have three documented ways around it:

  1. Edit PATH so the user npm folder comes before the Program Files nodejs folder, then restart the command prompt.
  2. Remove the npm and npm.cmd files from the Program Files nodejs folder.
  3. Copy the npmrc file out of the bundled npm folder, run the install from the nodejs folder in an administrator prompt, then copy it back.

If you used the first two, copy the npmrc file into the new npm folder.

Check where global installs go

The page suggests running npm config get prefix with the global flag. It should show a path under your user AppData npm folder. If not, it suggests setting the prefix to the APPDATA npm path with npm config set.

Updating npm is part of patching the toolchain

npm is code that runs install scripts on your machine. An old npm lacks newer behavior and fixes, and the version a developer has often depends on which Node.js they installed. That is another reason to keep one Node major per project. See which Node.js version should your team run.

The npm page does not say which npm versions work with which Node.js versions, so check your Node release notes before moving npm far ahead of your runtime.

Team approach

OptionWhen it fits
Use the npm bundled with NodeSimplest; update by moving the Node version
Update npm globallyIndividual machines, quick fixes
Pin the package manager per projectTeams that want identical behavior

For the last row, read how to pin the package manager with Corepack.

Safeguard's dependency scanning reads package-lock files and flags known issues in what npm installs. A free scan is at gold.safeguard.sh/scan.

Common mistakes

People often update npm in one terminal and check the version in another with a different PATH. They also run global installs with sudo out of habit, which can leave root-owned files in their home folder. Open a fresh terminal after changing PATH, and confirm with npm -v before concluding the update failed.

Quick check

Why does npm -v still show the old version on Windows?

The npm bundled with Node can take priority on PATH, so the shell keeps using it instead of the version you installed.

What command updates npm on macOS and Linux?

npm install -g npm@latest, possibly with sudo depending on how Node was installed.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.