Node Core Modules

After this lesson, you will be able to: Use the core modules: fs, path, os, http, events, stream, buffer, crypto.

Node ships everything you need for most server tasks without npm install.

Prerequisites:What is Node.js

fs + path + os

The daily-driver stdlib.

python

import { readFile, writeFile, mkdir, readdir } from "node:fs/promises";
import path from "node:path";
import os from "node:os";

// fs/promises (async; use this; not fs)
const data = await readFile("data.json", "utf-8");
await writeFile("out.txt", "hello");
await mkdir("./tmp", { recursive: true });

// path
const joined = path.join(__dirname, "src", "file.ts");
const ext = path.extname("/a/b/file.ts");   // ".ts"

// os
console.log(os.platform(), os.tmpdir(), os.cpus().length, os.homedir());

events: the EventEmitter pattern

Used everywhere in Node (streams, http, process).

python

import { EventEmitter } from "node:events";

const bus = new EventEmitter();
bus.on("user-created", (user) => console.log("new user:", user.id));
bus.emit("user-created", { id: "u1" });

// once = handler runs once + auto-removes
bus.once("shutdown", () => console.log("bye"));

crypto + buffer

Hashing + random + binary.

python

import { randomBytes, createHash, scrypt } from "node:crypto";
import { promisify } from "node:util";

// Random token
const token = randomBytes(32).toString("hex");

// Hash
const sha = createHash("sha256").update("hello").digest("hex");

// Password hashing (use scrypt or argon2 via npm, never SHA-256)
const scryptAsync = promisify(scrypt);
const salt = randomBytes(16);
const hash = await scryptAsync("password", salt, 64) as Buffer;

// Buffer (binary data)
const b = Buffer.from("hello", "utf-8");
console.log(b.toString("hex"));   // 68656c6c6f

Common mistakes only experienced Node devs avoid

Using callback `fs.readFile(path, cb)` in new code. fs/promises is cleaner. Mixing path separators manually. Use path.join. Storing passwords as SHA-256. Use bcrypt / scrypt / argon2 with salt + work factor. Forgetting `node:` prefix on imports. Best practice in modern Node.

Quick Check

Why use scrypt instead of SHA-256 for passwords?

Pick the security answer.

←What Node.js Is

Back to Node.js

npm and the Node Ecosystem→