Apps and helpers

What is node?

node is the Node.js runtime. It isn't part of macOS; you, Homebrew or another tool installed it. Its traffic is whatever the JavaScript it runs asks for, such as npm downloading packages.

Process: nodeAlso seen as: npm, npxMade by OpenJS Foundation (Node.js), installed by you or a toolApplies to: Node.js on macOS 14 Sonoma and later. Checked on 1 November 2026 against the npm documentation.Checked: 1 November 2026

Short answer

The Node.js runtime, not part of macOS. It connects only when a script asks, such as npm installing packages, a dev server, an AI agent or an MCP server.

Block with care

Blocking node blocks every Node.js program at once. Block the specific host instead, or stop the script you don't recognise.

Path
/opt/homebrew/bin/node /usr/local/bin/node ~/.nvm/versions/node/<version>/bin/node

What it is

node runs JavaScript programs outside a browser. Many tools are Node.js programs: npm, many AI coding agents, MCP servers and dev servers.

Its path shows how it was installed. Homebrew uses /opt/homebrew/bin on Apple silicon, and version managers keep copies under your home folder.

The npm documentation says that npm uses the public registry at https://registry.npmjs.org by default, unless you configure another one.

The same node binary can run many programs at once. Each one shows as a separate node process.

Why it uses the network

  • Package installs. npm install and npx download packages from the registry.
  • Programs you run. A dev server, a script or a CLI tool written in Node.js makes the requests its code asks for.
  • AI agents and MCP servers. Many coding agents and MCP servers run on Node.js and call their model provider's API.

How much is normal

Traffic while you install packages or run a tool is normal.

A node process that stays connected for hours is usually a server or an agent you started.

An unknown node process deserves a look. Its parent process and its command line show what it runs.

When it uses a lot, and why

  • A fresh install. Installing a project's dependencies for the first time downloads every package.
  • Agents and long tasks. An AI agent sends prompts and files to its provider and can run many tools in a row.
  • Uploads. A script that uploads build artefacts or logs sends as much as it uploads.

Is it safe to block?

Block with care

Blocking node blocks every Node.js program at once. Block the specific host instead, or stop the script you don't recognise.

What breaks if you block it

  • npm and npx can't install packages.
  • Dev servers, CLIs, AI agents and MCP servers that run on Node.js lose the network.
  • The rule applies to every program that this node binary runs.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

  1. Find what the process runs. In Terminal, show its command line, using its process ID.

    ps -o pid,ppid,command -p <pid>

  2. Stop scripts or servers that you don't need.

  3. Reuse npm's cache. Avoid deleting node_modules and reinstalling on a hotspot.

See how much it uses

  1. Open Activity Monitor from Applications › Utilities. Click Network.

  2. Type node in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.

  3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

    nettop -p 'node' -P

With Kilobat

  1. Kilobat shows command-line tools such as node with their executable path, so an unknown copy stands out.

  2. With Pro, the agent network log records every host an AI agent and the processes it starts contacted, node included.

    kilobat agent-log

  3. Ask the same question in Terminal.

    kilobat explain node

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

registry.npmjs.orgThe npm public registry, where npm downloads JavaScript packages by default.npm →

Questions

Why does node connect to the internet when I didn't start anything?

Some app or agent started it. Its parent process, from ps, says which.

Can I see which hosts an AI agent's node processes contacted?

Yes. Kilobat's agent network log records them, per agent session, with bytes and the process.

Sources

Checked on 1 November 2026.