Node.js 18.0.0–18.16.x shipped with npm 8 as the default. npm 8 requires Node ≥ 12.13.0 and uses lockfileVersion 2. All peer dependency strictness from npm 7 applies. Node 18.17.0+ ships npm 9. This is a stable combination but npm 10 is available via `npm install -g npm@10` for current security patches.