npm

npm is the package manager that comes with Node.js. It lets you install, update, and remove packages from the npm registry (https://www.npmjs.com ). You use it to add third-party libraries to your project.

Installing packages

Local install (for the current project). Saves to dependencies in package.json:

npm install express
npm install axios
npm i lodash   # i is an alias for install

Install as a devDependency (tools you only need during development, not in production):

npm install -D nodemon
npm install -D eslint

Install globally (available everywhere on your machine, not just one project):

npm install -g nodemon

Most packages should be installed locally so different projects can use different versions.

package.json

Every Node project has a package.json file. It stores project metadata, the list of dependencies, and scripts.

Create one with:

npm init -y    # -y accepts all defaults, fastest option
npm init       # interactive, asks you questions

A typical package.json:

{
  "name": "my-app",
  "version": "1.0.0",
  "description": "A simple Node app",
  "main": "index.js",
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "test": "jest"
  },
  "dependencies": {
    "express": "^5.0.0"
  },
  "devDependencies": {
    "nodemon": "^3.0.0"
  }
}

dependencies vs devDependencies

dependencies: packages your app needs to run in production (Express, axios, dotenv)
devDependencies: packages you only need when developing (nodemon, eslint, jest, TypeScript)

When someone runs npm install --production, devDependencies are skipped. Use -D or --save-dev to install as a devDependency.

npm scripts

Scripts let you define command shortcuts in package.json. Run them with npm run <name>:

npm run dev      # runs the "dev" script
npm run build    # runs the "build" script
npm start        # "start" does not need the run keyword
npm test         # "test" does not need the run keyword

Scripts can chain commands, set environment variables, or run any shell command. You can define as many scripts as you need.

package-lock.json

When you install packages, npm creates a package-lock.json file. This records the exact version of every installed package, including the dependencies of your dependencies. It ensures everyone on the team gets the same versions.

Commit package-lock.json to git. Never edit it manually.

node_modules

npm installs packages into a node_modules folder. This folder can be large and should never be committed to git. When someone clones your project, they run npm install to recreate it from package.json.

Add node_modules to your .gitignore:

node_modules/
.env

Useful npm commands

npm install              # install all dependencies from package.json
npm install express      # install a package
npm uninstall express    # remove a package
npm update               # update all packages to their allowed versions
npm outdated             # list packages with available updates
npm ls --depth=0         # list installed packages in this project
npm ls -g --depth=0      # list globally installed packages

npm vs pnpm vs yarn

npm is the default and works for most projects. You may encounter pnpm or yarn in other projects:

pnpm: faster installs, uses a shared package store to save disk space. Install with npm install -g pnpm, then use pnpm install.
yarn: developed by Meta, similar to npm with a slightly different syntax. Use yarn add express instead of npm install express.

All three read package.json. You can usually switch by running the other tool’s install command in the same project.

npm