How to install npm without curl | bash?

I know it is now customary to paste (or pipe!) shell scripts from webpages into ones root shell. In the recent past we called this "getting rooted" it was not something you did intentionally.

Source: https://nodejs.org/en/download/package-manager/#debian-and-ubuntu-based-linux-distributions

curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash -

This security model requires you to trust: curl, the Node project, the authors of nodesource.com, Google's ranking of nodesource.com, other people that might control nodesource.com, various cryptographic infrastructure between your computer and nodesource.com (TLS 1.0 anybody?), and most importantly, the immutability (resource integrity) of the resource at https://deb.nodesource.com/setup_8.x.

For important software, I am more used to trusting a distributor (Ubuntu) to review and validate these details for me.

Is there a better way to install npm for somebody that has more than a dog's level of understanding of computer security?

Solution

Here's what I did to install NodeJS 14 on Debian Bullseye:

Copy node's key from https://deb.nodesource.com/gpgkey/nodesource.gpg.key
Paste this into a new file called /etc/apt/trusted.gpg.d/nodejs.asc
Run echo "deb https://deb.nodesource.com/node_14.x $(lsb_release -c -s) main" to get the source entry. For me this was "deb https://deb.nodesource.com/node_14.x bullseye main"
Paste the source entry from step 3 to a new file called /etc/apt/sources.list.d/nodesource.list
sudo apt update
sudo apt install nodejs
Check it worked: node -v