npm

Definition

npm is the default package manager bundled with Node.js, used to install, publish, and manage JavaScript packages from the npm registry, the largest software package repository in the world. It also functions as a build tool through its script-running capability, letting developers define and execute project tasks such as tests, builds, and linting from a single `package.json` configuration file, making it the entry point for most JavaScript project workflows.

Overview

npm exists to solve dependency management for JavaScript: before it, developers manually downloaded libraries and managed version conflicts by hand, which did not scale as the ecosystem grew. npm introduced a standard manifest file, `package.json`, that declares a project's dependencies and their version ranges, and a central registry that hosts published packages so any project can pull them down with a single command. This combination made JavaScript's package ecosystem one of the largest in software, spanning everything from single-function utility libraries to full frameworks. Mechanically, running `npm install` reads `package.json`, resolves a dependency graph that satisfies every package's declared version ranges, downloads the matching package tarballs from the registry, and writes them into a `node_modules` folder alongside a `package-lock.json` file that pins exact resolved versions for reproducible installs. npm also supports scoped packages (namespaced under an organization), semantic versioning ranges (caret and tilde operators), and a scripting system where arbitrary shell commands can be registered under `scripts` in `package.json` and invoked with `npm run <name>`. npm sits alongside Yarn and pnpm as the three major Node.js package managers. Yarn was created partly in response to early npm performance and determinism issues and popularized the lockfile concept that npm later adopted itself. pnpm takes a different approach to disk usage, using a content-addressable store and symlinks so that shared dependencies across projects are not duplicated on disk, which can meaningfully reduce install size and time on machines with many Node.js projects. Despite these alternatives, npm remains the default because it ships with every Node.js installation. In practice, npm is used to add third-party libraries to a project, publish reusable packages to the public or a private registry, and orchestrate build pipelines through its script runner, often invoking bundlers like webpack or Vite, test runners like Jest, and linters like ESLint. Organizations also run private npm registries or scoped packages to share internal code without publishing it publicly. npm's known trade-offs include historically slower install times compared to pnpm's linking strategy, and the risk that comes with any large public package registry: supply-chain issues such as compromised or malicious packages have occurred, which is why lockfiles, automated vulnerability scanning (`npm audit`), and careful dependency review are standard practice. The sheer size of typical `node_modules` folders is also a common complaint, sometimes called "the heaviest object in the universe" in developer jokes about their disk footprint, a joke that persists precisely because it remains true across most real projects.

Key Features

• manages project dependencies declared in a package.json manifest file
• resolves and installs packages from the public npm registry
• generates package-lock.json files for reproducible, deterministic installs
• supports custom build and task scripts run via npm run
• supports scoped packages for namespacing organization-owned code
• provides npm audit for scanning installed packages for known vulnerabilities
• allows publishing packages publicly or to private registries
• ships bundled with every standard Node.js installation

Use Cases

Alternatives

Frequently Asked Questions

Related in Web