What Is npm and How Package Management Works

1What Is npm?

npm is the default package manager for Node.js — a command-line tool and an online registry that together let you install reusable code libraries, called packages, into your projects. Instead of writing everything yourself, you pull in a package with npm install and use it immediately.

The registry hosts a vast collection of open-source packages, from tiny utilities to full frameworks. npm handles downloading them, tracking which versions your project uses, and resolving the web of packages that those packages themselves depend on.

2The package.json Manifest

package.json is the heart of any Node project. It is a JSON file describing your project — its name, version, scripts, and crucially its dependencies. npm reads it to know what to install and writes to it when you add a package.

• npm init -y // create a package.json
• {
• "name": "my-app",
• "version": "1.0.0",
• "scripts": { "start": "node index.js" },
• "dependencies": { "express": "^4.18.0" }
• }

3Installing Packages

npm install is the command you will run most. With a package name it adds a new dependency; with no arguments it installs everything listed in package.json. Flags control whether a package is a runtime dependency or a development-only one.

• npm install express // add a runtime dependency
• npm install --save-dev jest // add a dev dependency
• npm install -g nodemon // install globally as a CLI
• npm install // install all listed dependencies
• npm uninstall express // remove a dependency

4node_modules and the Lockfile

When you install, npm downloads packages into a node_modules folder and records the exact resolved versions in package-lock.json. The node_modules directory can be huge and is regenerated from the manifest, so it is excluded from Git; the lockfile, by contrast, is committed.

• node_modules/ // downloaded packages, add to .gitignore
• package.json // your declared dependencies, committed
• package-lock.json // exact resolved versions, committed

5Semantic Versioning

npm packages follow semantic versioning, written as MAJOR.MINOR.PATCH. A major bump signals breaking changes, a minor bump adds features backward-compatibly, and a patch bump fixes bugs. The range symbols in package.json decide how much of a package you let npm update.

• 4.18.2 — MAJOR.MINOR.PATCH
• ^4.18.2 — allow minor and patch updates (up to <5.0.0)
• ~4.18.2 — allow patch updates only (up to <4.19.0)
• 4.18.2 — exact version, no updates
• * — any version (avoid; unpredictable)

6dependencies vs devDependencies

npm distinguishes packages your application needs to run from those needed only while developing. Runtime libraries like Express go in dependencies; tools like test runners, linters, and bundlers go in devDependencies and are skipped in production installs.

• dependencies: shipped and required at runtime (express, react).
• devDependencies: build and test tooling (jest, eslint, typescript).
• npm install --omit=dev installs only runtime dependencies.
• Getting this split right keeps production installs lean.

7Scripts, npx, and Scoped Packages

npm does more than install. The scripts you define run with npm run, and npx executes a package binary without a global install — handy for one-off tools. Scoped packages, written @scope/name, group packages under an organisation or user namespace.

• npm run build // run a defined script
• npx create-react-app x // run a CLI without installing globally
• @babel/core // a scoped package under @babel

8Common Mistakes to Avoid

A few npm habits cause avoidable pain.

• Committing node_modules to Git instead of adding it to .gitignore.
• Not committing package-lock.json, which makes builds non-reproducible.
• Putting build or test tools in dependencies, bloating production installs.
• Deleting the lockfile to 'fix' an install problem, discarding pinned versions.
• Installing packages globally when a local dev dependency would be cleaner.

9Key Takeaways

npm's core concepts fit together into a predictable workflow.

• npm installs and versions the packages your project depends on.
• package.json declares dependencies; package-lock.json pins them exactly.
• Commit the lockfile; ignore node_modules.
• Semantic versioning and ^/~ ranges control which updates you accept.
• Keep runtime libraries in dependencies and tooling in devDependencies.

10Frequently Asked Questions

Q: What is the difference between package.json and package-lock.json? A: package.json declares your dependencies with version ranges and is edited by you, while package-lock.json records the exact resolved version of every package and sub-package. The lockfile guarantees everyone installs the same tree.

Q: Should I commit node_modules to Git? A: No. node_modules is large and fully reproducible from package.json and the lockfile. Add it to .gitignore and commit package-lock.json instead so anyone can regenerate the exact same folder with npm install.

Q: What does the caret in ^4.18.0 mean? A: It tells npm to accept any compatible newer version below the next major release — so minor and patch updates up to but not including 5.0.0. It balances receiving fixes with avoiding breaking changes.

Q: What is the difference between npm and npx? A: npm installs and manages packages, while npx executes a package's command-line binary, downloading it temporarily if needed. npx is ideal for running one-off tools like project scaffolders without a permanent global install.