Turns out I accidentally swapped the ikm and salt arguments in the NodeJS code, here is the corrected code:

import crypto from 'crypto';

const input = Buffer.from("helloworld");
const salt = Buffer.alloc(32, 0); // Explicit salt

const output = crypto.hkdfSync('sha256', input, salt, Buffer.alloc(0), 48); // Correct use of `input` as IKM

console.log(Buffer.from(output).toString("hex"));