Setup before class
Tested runtime: Node 22.17.1 with npm 11.9.0 on macOS. Install Node from https://nodejs.org/ and confirm node --version and npm --version. A currently maintained compatible runtime may work, but rerun the lab before teaching on a different version.
Manager versions used: npm 11.9.0; pnpm 11.25.0; Yarn Classic 1.22.22; Yarn Berry 4.18.1; Bun 1.3.11. Select one track and follow its MANAGER-SETUP.md (distributed kit) or examples/
The Berry track uses node-modules, not PnP. Modern Bun text lockfiles are included. Older Bun binary lockfiles, Yarn PnP, legacy pnpm lockfiles and every historical manager version are outside the tested curriculum.
CVE Lite is invoked separately using:
npm exec --yes --package=cve-lite-cli@1.40.0 -- cve-lite . --json --all --no-open
This intentionally uses npm as a scanner launcher in every track, not as the sample project's dependency manager. Never run npm install in the pnpm/Yarn/Bun sample. The scanner's native SQLite dependency may need an approved prebuilt binary or compiler toolchain. Unlike sample installs, scanner installation may execute its required install scripts. Preflight this on classroom computers before the lesson.
The application dependency install commands disable lifecycle scripts. Use only supplied benign input. Install first, then run node --test and node src/app.mjs inside the selected app.
The tests should report four passes. The app prints counts Security: 2, Web: 1, and a URL at example.invalid. It never sends that request.
For a network-restricted classroom, install approved dependencies ahead of time. If scans cannot run, explicitly switch to analysis of the supplied captured reports. That is not an offline live scan. Grade the explanation, not fabricated execution.