Stop 02 · Node.js FundamentalsTopics · 6/18

NPM & Package Management

In short

You don't write your own web framework, date library or password hasher. npm pulls them in with one command, and if you're careless, it pulls in bugs and bloat too.

Node Package Manager — the tool and registry used to install, publish and manage third-party JavaScript packages your backend depends on.

The mascot shopkeeper receives a cart of boxes from a wholesaler and ticks items off a long bill.

Think of it like this

The kirana store's wholesaler

The kirana uncle doesn't bake his own biscuits. He orders from a wholesaler, and the bill lists the exact item and batch, so next month's order matches. npm is your wholesaler, and package-lock.json is that bill with exact versions.

Watch it happen

What npm install express does

You

npm CLI

Registry

node_modules

npm install express

1/6You ask for a package by name.

The big ideas

What you need to know

Two kinds of dependency

dependencies are needed to run the app. devDependencies, added with -D, are only for building and testing.

Commit the lockfile

package-lock.json makes every laptop and server install the exact same versions. Always commit it.

npm ci for clean installs

npm ci installs exactly what the lockfile says and fails if it doesn't match package.json. Use it in CI and Docker.

Every package is code you trust

A package runs with your app's full permissions. Fewer, well-known dependencies mean fewer surprises.

How it works

Picking a package without regret

1
Search
Look on npmjs.com for a few packages that solve your problem.
2
Check its health
Compare weekly downloads, last publish date and open issues on the repository.
3
Check the cost
See how many dependencies it brings along. Smaller is usually better.
4
Install and lock
npm install it, then commit package.json and package-lock.json together.
5
Keep an eye on it
Run npm outdated and npm audit now and then, and update on purpose.

See it in code

Walk through the code

bash

1npm init -y                  # create package.json2npm install express          # add a runtime dependency3npm install -D typescript    # add a dev-only dependency4npm uninstall lodash         # remove one5 6npm ci                       # clean install exactly from package-lock.json7npm outdated                 # see which packages have newer versions8npm audit                    # check for known vulnerabilities9npx tsc --version            # run a package's CLI without a global install

1/4Create the project, then add and remove packages. package.json and the lockfile update together.

npm ci deletes node_modules and installs exactly what the lockfile says, which makes it the right choice for CI servers and Docker builds.

Save yourself the pain

Common mistakes

Oops

Committing node_modules to Git.

Do this instead

Commit package.json and package-lock.json, and add node_modules to .gitignore. Anyone can rebuild it with npm ci.

Oops

Installing whatever package name looks right, typos and all.

Do this instead

Lookalike names can be malicious. Check the exact name, the downloads and the linked repository before installing.

Your mission

Set up a project properly

~15 min

Quick check

Your teammate's laptop and the CI server should install the exact same versions. What makes that happen?

Go deeper

1Initialize a project with `npm init` and install a package with `npm install`.
2Learn `npm ci` vs `npm install` and when each is appropriate.
3Explore alternatives (pnpm, Yarn) and understand what problem each solves.