What is npm in Node.js?
Learn what npm is, how package.json and package-lock.json manage dependencies, and the key npm commands every Node.js developer should know.
Expected Interview Answer
npm (Node Package Manager) is the default package manager for Node.js — a command-line tool plus an online registry used to install, share, version, and manage the third-party libraries (packages) your project depends on.
Every Node project has a package.json file that declares its dependencies and scripts. Running npm install downloads those packages into node_modules and records exact resolved versions in package-lock.json for reproducible builds. npm also runs scripts (like npm run build), supports semantic versioning ranges, and connects to the public npm registry that hosts millions of open-source packages.
- Easy installation and reuse of open-source libraries
- Declarative dependency management via package.json
- Reproducible installs with package-lock.json
- Built-in script runner for common tasks
- Semantic versioning to control safe updates
AI Mentor Explanation
npm is like a cricket team's kit manager who keeps a master list of every player's required gear and fetches it from the central stores. When a new player joins, one request outfits them from the same trusted supply. package.json is that gear list, and npm install is the manager stocking the dressing room from the shared store.
Step-by-Step Explanation
Step 1
Initialize the project
Run npm init to create a package.json that describes your project and its dependencies.
Step 2
Install a package
npm install express adds Express to node_modules and lists it under dependencies.
Step 3
Lock the versions
npm writes package-lock.json recording the exact resolved versions for reproducible installs.
Step 4
Use scripts
Define scripts in package.json and run them with npm run <name>, e.g. npm run build.
Step 5
Restore anywhere
On another machine, npm install reads package.json and the lock file to recreate node_modules exactly.
What Interviewer Expects
- Knows npm is the default Node.js package manager
- Understands package.json declares dependencies and scripts
- Explains the purpose of package-lock.json
- Distinguishes dependencies from devDependencies
- Aware of semantic versioning ranges (^ and ~)
Common Mistakes
- Confusing npm the CLI with the online registry
- Committing node_modules instead of the lock file
- Not understanding what package-lock.json is for
- Mixing dependencies and devDependencies incorrectly
- Thinking npm and npx are the same thing
Best Answer (HR Friendly)
“npm is the tool Node.js developers use to download and manage the free code libraries their projects rely on. It keeps a list of what a project needs so anyone can install the exact same setup, which saves time and avoids reinventing common functionality.”
Code Example
{
"name": "my-app",
"version": "1.0.0",
"scripts": {
"start": "node index.js",
"test": "jest"
},
"dependencies": {
"express": "^4.19.2"
},
"devDependencies": {
"jest": "^29.7.0"
}
}// Install all dependencies listed in package.json
// $ npm install
// Add a runtime dependency
// $ npm install express
// Add a dev-only dependency
// $ npm install --save-dev jest
// Run a script defined in package.json
// $ npm run start
const express = require('express');
const app = express();
app.get('/', (req, res) => res.send('Hello'));
app.listen(3000);Follow-up Questions
- What is the difference between dependencies and devDependencies?
- What does package-lock.json do and should you commit it?
- What is the difference between npm and npx?
- How does semantic versioning (^ vs ~) affect updates?
- What is the difference between npm install and npm ci?
MCQ Practice
1. Which file declares a project's dependencies and scripts?
package.json declares metadata, dependencies, and scripts; the lock file records exact resolved versions.
2. What is the main purpose of package-lock.json?
package-lock.json records the exact versions of the whole dependency tree so installs are reproducible across machines.
3. Which command installs a package only for development use?
The --save-dev flag adds the package to devDependencies, used for tooling like testing and not shipped to production.
Flash Cards
What is npm? — The default package manager for Node.js: a CLI plus an online registry for installing and managing packages.
What is package.json? — The manifest declaring a project's metadata, dependencies, devDependencies, and scripts.
Why commit package-lock.json? — It pins the exact versions of the entire dependency tree, guaranteeing reproducible installs.
dependencies vs devDependencies? — dependencies are needed at runtime; devDependencies are only needed during development and testing.