True, just because its there now doesn't mean it will be in the future, but I'm not so concerned about that race.

What bothers me more that after sufficient time, a pid could be reused, and the pid would be found, but not be the process that created the lock file. In the absence of file locks, or some resource that auto-deletes on process death (and I can't think of a reasonable cross-platform such thing available with node), I don't think I can do better.

Can you think of a better way?

I searched npmjs.org, and alternative pid writers either do worse than this, or do things like read /proc/... for the image name, and some such. I'm hoping upstart or systemd will do better than this in their process wrapping, if they are used.