--- title: "node: why Node.js uses the network on a Mac, and whether to block it · Kilobat" url: "https://kilobat.app/processes/node" description: "node is the Node.js runtime. Why it connects, why npm downloads so much, how to tell which script is behind it, and what breaks if you block it." --- Apps and helpers # What is node? `node` is the Node.js runtime. It isn't part of macOS; you, Homebrew or another tool installed it. Its traffic is whatever the JavaScript it runs asks for, such as npm downloading packages. Process: `node` · Also seen as: `npm`, `npx` · Made by OpenJS Foundation (Node.js), installed by you or a tool · Applies to: Node.js on macOS 14 Sonoma and later. Checked on 1 November 2026 against the npm documentation. · Checked: 1 November 2026 ## Short answer The Node.js runtime, not part of macOS. It connects only when a script asks, such as npm installing packages, a dev server, an AI agent or an MCP server. Block with care Blocking node blocks every Node.js program at once. Block the specific host instead, or stop the script you don't recognise. Path `/opt/homebrew/bin/node` `/usr/local/bin/node` `~/.nvm/versions/node//bin/node` ## What it is `node` runs JavaScript programs outside a browser. Many tools are Node.js programs: npm, many AI coding agents, MCP servers and dev servers. Its path shows how it was installed. Homebrew uses `/opt/homebrew/bin` on Apple silicon, and version managers keep copies under your home folder. The npm documentation says that npm uses the public registry at `https://registry.npmjs.org` by default, unless you configure another one. The same `node` binary can run many programs at once. Each one shows as a separate `node` process. ## Why it uses the network - **Package installs.** `npm install` and `npx` download packages from the registry. - **Programs you run.** A dev server, a script or a CLI tool written in Node.js makes the requests its code asks for. - **AI agents and MCP servers.** Many coding agents and MCP servers run on Node.js and call their model provider's API. ## How much is normal Traffic while you install packages or run a tool is normal. A `node` process that stays connected for hours is usually a server or an agent you started. An unknown `node` process deserves a look. Its parent process and its command line show what it runs. ## When it uses a lot, and why - **A fresh install.** Installing a project's dependencies for the first time downloads every package. - **Agents and long tasks.** An AI agent sends prompts and files to its provider and can run many tools in a row. - **Uploads.** A script that uploads build artefacts or logs sends as much as it uploads. ## Is it safe to block? Block with care Blocking node blocks every Node.js program at once. Block the specific host instead, or stop the script you don't recognise. What breaks if you block it - npm and npx can't install packages. - Dev servers, CLIs, AI agents and MCP servers that run on Node.js lose the network. - The rule applies to every program that this node binary runs. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. Find what the process runs. In Terminal, show its command line, using its process ID. ``` ps -o pid,ppid,command -p ``` 2. Stop scripts or servers that you don't need. 3. Reuse npm's cache. Avoid deleting `node_modules` and reinstalling on a hotspot. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `node` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. ``` nettop -p 'node' -P ``` ## With Kilobat 1. Kilobat shows command-line tools such as node with their executable path, so an unknown copy stands out. 2. With Pro, the agent network log records every host an AI agent and the processes it starts contacted, node included. ``` kilobat agent-log ``` 3. Ask the same question in Terminal. ``` kilobat explain node ``` The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [registry.npmjs.org](https://kilobat.app/hosts/registry-npmjs-org): The npm public registry, where npm downloads JavaScript packages by default. ## Questions **Why does node connect to the internet when I didn't start anything?** Some app or agent started it. Its parent process, from `ps`, says which. **Can I see which hosts an AI agent's node processes contacted?** Yes. Kilobat's agent network log records them, per agent session, with bytes and the process. ## Sources - [npm Docs: registry](https://docs.npmjs.com/cli/v11/using-npm/registry) - ps(1), man page installed with macOS 27.2 - [Kilobat docs: Agent network log](https://kilobat.app/docs/agents#agent-network-log) Checked on 1 November 2026. ## Related - [Electron Helper](https://kilobat.app/processes/electron-helpers): Part of an app built on Electron. Electron apps run their windows and their network work in helper processes, so the app's traffic shows under “App Helper”. - [“npm error code ETIMEDOUT” on Mac](https://kilobat.app/guides/npm-etimedout) - [“npm error code ECONNRESET” on Mac](https://kilobat.app/guides/npm-econnreset) - [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails)