Install Node.js and npm on Kali Linux

Node.js runs JavaScript outside the browser. On Kali you typically install it for security lab tools such as OWASP Juice Shop, local JavaScript utilities, or coursework — not because Kali ships a graphical app store for Node apps.

This guide installs Node.js and npm from the Kali rolling repository for a maintained system-wide runtime, or with nvm when you need multiple versions per user. Commands below were captured on Kali Rolling 2026.2 with nodejs 24.18.0 from apt and nvm 0.40.3.

Choose a Node.js installation method

Recommendation:

• Use apt when a Kali package or lab guide expects the distribution Node build.
• Use nvm when projects need different majors (for example Node 22 for one repo and 24 for another).
• Do not run NodeSource setup_*.x scripts or compile from source as the default path on Kali.

Check existing Node.js and npm

Before you install anything, see whether node and npm already exist and which path wins in your shell.

command -v node

/usr/bin/node

command -v npm

/usr/bin/npm

node --version

v24.18.0

npm --version

11.16.0

Paths under /usr/bin usually come from Kali apt packages. After you install nvm, command -v node may point to ~/.nvm/versions/node/.../bin/node instead — that is expected when nvm prepends its directory to PATH.

See which versions apt would install today:

apt-cache policy nodejs npm

nodejs:
  Installed: 24.18.0+dfsg+~cs24.13.2-1
  Candidate: 24.18.0+dfsg+~cs24.13.2-1
  Version table:
 *** 24.18.0+dfsg+~cs24.13.2-1 500
        500 http://http.kali.org/kali kali-rolling/main amd64 Packages
npm:
  Installed: 11.16.0+ds2-1
  Candidate: 11.16.0+ds2-1
  Version table:
 *** 11.16.0+ds2-1 500
        500 http://http.kali.org/kali kali-rolling/main amd64 Packages

The 500 … kali-rolling/main origin confirms these builds come from the rolling mirror, not a third-party NodeSource line. Exact version numbers change over time — always read Candidate on your own system after sudo apt update.

Confirm binaries on disk:

ls -la "$(command -v node)" "$(command -v npm)"

-rwxr-xr-x 1 root root 26704 Jun 25 14:42 /usr/bin/node
lrwxrwxrwx 1 root root    34 Jun  1 10:51 /usr/bin/npm -> ../share/nodejs/npm/bin/npm-cli.js

On this image, /usr/bin/nodejs is a symlink to node as well — some older Debian docs only mention the nodejs command name.

Install Node.js from the Kali repository

Kali rolling ships current Node.js builds in main. Refresh indexes before you install:

sudo apt update

Install the runtime and npm package together:

sudo apt install -y nodejs npm

nodejs is already the newest version (24.18.0+dfsg+~cs24.13.2-1).
npm is already the newest version (11.16.0+ds2-1).

On a system that never had Node installed, apt prints Unpacking nodejs and Unpacking npm lines instead of the “already the newest version” message. Both outcomes leave nodejs and npm registered in dpkg.

Verify the runtime and package manager:

node --version

v24.18.0

npm --version

11.16.0

Do not hardcode outdated claims such as “Kali only has Node 12.” Rolling moved to Node 24 on the 2026.2 image used here. Re-check apt-cache policy nodejs after every apt update when a lab requires a specific major.

Create and run a test project

A one-file script confirms that your user can create projects and run node without sudo.

LAB=/tmp/node-kali-lab
mkdir -p "$LAB"
cd "$LAB"

Initialize a minimal npm project:

npm init -y

"license": "ISC",
  "type": "commonjs"
}

Create and run a hello script:

echo 'console.log("node-kali-lab ok");' > app.js
node app.js

node-kali-lab ok

When that line prints as a normal user, local project permissions and the active node binary are working. If this step fails with EACCES, fix ownership on "$LAB" rather than running sudo npm init.

Install Node.js with nvm

nvm (Node Version Manager) installs Node under your home directory and switches versions by changing PATH. Use it when apt’s single system version is not enough.

Download and run the current upstream installer (v0.40.3 at test time):

curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash

=> Downloading nvm from git to '/root/.nvm'
=> Cloning into '/root/.nvm'...
=> Appending nvm source string to /root/.zshrc
...
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"

The installer appends lines to your shell rc file. Open a new terminal or load nvm in the current shell:

export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && . "$NVM_DIR/nvm.sh"
nvm --version

0.40.3

Install the current LTS Node build and select it:

nvm install --lts

Installing latest LTS version.
Downloading and installing node v24.18.1...
Checksums matched!
Now using node v24.18.1 (npm v11.16.0)
Creating default alias: default -> lts/* (-> v24.18.1 *)

nvm use --lts
node --version
npm --version

Now using node v24.18.1 (npm v11.16.0)
v24.18.1
11.16.0

nvm does not remove apt’s /usr/bin/node. Whichever path appears first in PATH after nvm use is the version your shell runs. Do not use sudo npm for packages managed by nvm — globals land under your nvm prefix, not /usr.

Non-interactive shells, cron, and systemd services do not load nvm unless you export NVM_DIR and source nvm.sh in that environment explicitly.

Install and switch multiple Node versions

Install additional majors when a project or Juice Shop source install requires them:

nvm install 22

Downloading and installing node v22.23.2...
Checksums matched!
Now using node v22.23.2 (npm v10.9.8)

Switch active version in the current shell:

nvm use 22
node --version

Now using node v22.23.2 (npm v10.9.8)
v22.23.2

Set the default for new shells:

nvm alias default 22

default -> 22 (-> v22.23.2 *)

List installed builds:

nvm ls

->     v22.23.2 *
       v24.18.1 *
         system *
default -> 22 (-> v22.23.2 *)

The system entry represents /usr/bin/node from apt. Prefer LTS releases for long-lived labs. Current tracks the newest feature release and moves faster. End-of-life majors break npm install when native modules or engines stop supporting them.

Use a project .nvmrc file

Teams pin a major version in .nvmrc so everyone selects the same runtime.

In your project directory:

cd "$LAB"
echo "22" > .nvmrc

Install that major if nvm does not have it yet, then activate:

nvm install 22
nvm use

Found '/tmp/node-kali-lab/.nvmrc' with version <22>
Now using node v22.23.2 (npm v10.9.8)

If you only run nvm use without installing first, nvm may print Found '.nvmrc' with version <22> and exit without switching — run nvm install for that major, then nvm use again.

Install global npm commands safely

Local dependencies live in node_modules inside the project and are the default for application code.

Global CLI tools install into a prefix directory. With nvm:

npm install --global <package>

Do not prefix that with sudo. Globals install under the active nvm Node prefix (for example ~/.nvm/versions/node/v22.23.2/bin).

For apt-installed Node:

• Prefer sudo apt install <tool> when Kali ships the CLI.
• Do not chown -R /usr or chmod system directories to fix npm EACCES.
• Do not run sudo npm install -g for random packages — lifecycle scripts execute as root.

Avoid npm install -g npm@next as general advice. npm major releases track Node; forcing a far newer npm than your Node build supports can break the CLI.

Optional — official binary archive

Use the Linux x64 tarball from nodejs.org when you need a fixed path outside apt and nvm — not as the default Kali workflow.

1. Download the LTS linux-x64 archive and the published SHASUMS256.txt for the same version.
2. Verify with sha256sum -c SHASUMS256.txt against the tarball.
3. Extract under /opt/node-vVERSION-linux-x64 (or another root-owned path).
4. Add /opt/node-vVERSION-linux-x64/bin to PATH in your shell rc — not by copying files into /usr piecemeal.
5. Confirm with command -v node pointing at the /opt binary.
6. Remove by deleting the extract directory and cleaning PATH — no apt purge applies.

This path does not register in dpkg. Keep apt and nvm installs separate to avoid three competing node binaries.

Update Node.js and npm

APT installation

sudo apt update
sudo apt full-upgrade

Rolling updates refresh nodejs and npm when Kali publishes new packages. Re-run node --version and apt-cache policy nodejs after upgrades.

nvm installation

nvm install --lts --reinstall-packages-from=current
nvm alias default 'lts/*'

--reinstall-packages-from=current moves global npm packages from the previously active nvm version to the new LTS build. Skip independent npm major upgrades unless a project documents the requirement — npm and Node ship as a matched pair in each nvm install.

Remove Node.js

APT packages

sudo apt purge nodejs npm
sudo apt autoremove

Purging drops the system node and npm binaries under /usr. Confirm with command -v node returning nothing before you rely on nvm alone.

nvm versions

Remove one version:

nvm uninstall 24.18.1

Delete the entire nvm tree only when no projects need it:

rm -rf ~/.nvm

Remove the nvm lines from ~/.bashrc or ~/.zshrc and open a new shell. If apt Node remains installed, command -v node returns /usr/bin/node again.

Troubleshoot Node.js on Kali

References

• Node.js documentation
• npm documentation
• nvm project
• Kali apt sources

Summary

On current Kali rolling releases, sudo apt install nodejs npm delivers a maintained system-wide Node.js and npm pair from kali-rolling — 24.18.0 and 11.16.0 on the 2026.2 image tested here, not the outdated Node 12 or 14 versions old posts mention. Use that path for lab packages and quick scripts, then confirm with node --version and a trivial node app.js run in a normal-user project directory.

When you need multiple majors or tighter control per developer account, install nvm under your home directory, run nvm install --lts or nvm install 22, and pin teams with .nvmrc plus nvm use. Do not mix apt, nvm, /usr/local copies, and NodeSource repositories without cleaning PATH and removing the old install — the wrong node binary is a common silent failure.

For permission errors, prefer local project installs and nvm globals over sudo npm or ownership hacks on /usr. When apt dependency or mirror issues block nodejs entirely, fix Kali Linux repositories first. For vulnerable web labs that depend on Node, compare the Kali package, Docker, and source paths in Install OWASP Juice Shop on Kali Linux before you chase Node versions in isolation.