npm Package Manager

What Is npm?

npm is both a command-line tool and a public registry of JavaScript packages. Instead of writing every utility yourself, you install existing packages (express, lodash, dotenv, thousands more) and manage them through your project's package.json file.

Every package you install gets downloaded into a local node_modules folder, and its exact version is recorded in package.json (as a range) and package-lock.json (as an exact, reproducible version), so teammates and CI servers install the identical dependency tree.

npm install express        # add a dependency and save it to package.json
npm install --save-dev jest # add a dev-only dependency
npm install                 # install everything already listed in package.json
npm uninstall express       # remove a dependency

npm install with no arguments reads package.json/package-lock.json and installs the exact dependency tree they describe, this is what you run right after cloning a project.

Core npm Commands

npm init -y
npm install <package>
npm install <package> --save-dev
npm install <package>@<version>
npm uninstall <package>
npm update
npm run <script-name>

• npm install <pkg> adds a regular dependency needed at runtime.
• npm install <pkg> --save-dev (or -D) adds a dependency only needed during development (like a test runner).
• npm run <script> executes a named script defined in package.json's "scripts" field.
• npx <command> runs a package's CLI without installing it globally first.

npm Commands Cheatsheet

The npm commands you will run constantly while building Node.js projects.

Semantic Versioning (SemVer)

npm packages follow semantic versioning: MAJOR.MINOR.PATCH (e.g. 4.18.2). Major bumps can break compatibility, minor bumps add features safely, and patch bumps fix bugs without changing the API. package.json uses range prefixes to control how much auto-updating is allowed.

Why package-lock.json Matters

package.json records acceptable version ranges, but package-lock.json records the exact, resolved version of every package (and its dependencies) that was actually installed. Committing the lockfile guarantees that everyone on the team, and your CI/production servers, install identical dependency trees.

• Always commit package-lock.json to version control.
• Use npm ci (not npm install) in CI/CD pipelines, it installs exactly what the lockfile specifies and fails if it's out of sync.
• Never hand-edit package-lock.json directly.

Common Mistakes

• Deleting package-lock.json "to fix an error" without understanding it also erases version reproducibility.
• Installing a package that should only be used in development (like a test runner) as a regular dependency.
• Committing the node_modules folder to version control instead of relying on package.json/lockfile.
• Running npm install in CI pipelines instead of the faster, stricter npm ci.

Key Takeaways

• npm is both the command-line tool and the registry Node.js uses to install and share packages.
• package.json lists dependency version ranges; package-lock.json pins exact resolved versions.
• Use --save-dev for tools only needed during development, not at runtime.
• npx runs a package's CLI on demand without a permanent global install.