What is node on Mac?

What node is

node is the Node.js runtime. Every node process is running some JavaScript file: your dev server, a bundler in watch mode, a TypeScript or ESLint server, a test runner, a CLI like Claude Code, or an MCP server. It may live in /opt/homebrew/bin/node, ~/.nvm/versions/node/..., ~/.volta, ~/.local/share/fnm or similar, depending on how you installed it.

Many desktop apps bundle their own Node, but those usually show up under the app’s name (for example Code Helper (Plugin) for VS Code).

Why it uses CPU and memory

• Dev servers rebuilding: next dev, Vite and webpack recompile on every save. Large apps take seconds of full CPU per change.
• Watchers: several forgotten servers watching the same tree. See fseventsd.
• TypeScript checks (tsc --watch, the editor’s TS server) on big projects use 1–3 GB.
• Tests in watch mode: Jest and Vitest spawn workers per CPU core.
• Agents: Claude Code and other CLIs run on Node and spawn their own child processes.
• A busy loop or leak in your own code.

Find out which one it is

# All node processes with uptime and full command
ps -axo pid,ppid,etime,%cpu,rss,command | grep '[n]ode'

# Which project folder a PID is running in
lsof -a -p <pid> -d cwd -Fn | tail -1

# Which port it's serving
lsof -nP -a -p <pid> -iTCP -sTCP:LISTEN

ppid of 1 means its terminal is gone and it’s an orphan. Otherwise follow the parent chain (ps -o ppid,command -p <ppid>) back to a shell and the app that owns it: Terminal, iTerm, Ghostty, VS Code, Cursor or an agent.

How to stop it safely

Stop one process gracefully:

kill <pid>

Wait a couple of seconds; use kill -9 <pid> only if it won’t exit. To stop whatever is on a port, see how to kill a process on a port. For many leftovers at once, see finding orphaned node processes.

Avoid killall node unless you’re sure: it also ends your editor’s language tooling and any running agent sessions.

When to worry

Node itself is benign, but it runs any script it’s given, including install scripts from npm packages. Be suspicious of a node process that:

• runs from /tmp, ~/Library/Application Support/<random> or a hidden folder
• was started by a LaunchAgent you don’t recognize
• connects to hosts you don’t know while you’re not working

Check the binary with codesign -dv --verbose=2 $(which node) (the installer from nodejs.org carries a Developer ID signature; Homebrew, nvm and similar builds are usually ad-hoc signed) and the script it’s running with ps -o command -p <pid>.

Seeing it in Stat Space

Stat Space names node processes by what they run (node vite (my-app)) and groups them under the app that started them, so a dev server from Ghostty shows up under Ghostty. The Ports tab shows each server’s project, framework, launcher and uptime. Agent watch lists Claude Code, Codex and Cursor sessions with their child processes, and orphan sweep finds dev processes left behind after a terminal or agent closed, asking before it stops anything.