Node.js npm Package Manager

What is npm Package Manager in Node.js?

npm installs and manages the packages a project depends on. package.json records those dependencies and the scripts you run; package-lock.json pins the exact resolved versions so every install is reproducible.

npm Package Manager example

npm init -y                  # create package.json
npm install express          # add a runtime dependency
npm install -D nodemon       # add a development-only dependency
npm install                  # install everything in package.json
npm ci                       # clean install from the lock file (use in CI)
npm run dev                  # run a script
npm outdated                 # list packages with newer versions
npm audit fix                # patch known vulnerabilities

A typical package.json

{
  "name": "job-api",
  "type": "module",
  "scripts": {
    "dev": "node --watch src/index.js",
    "start": "node src/index.js",
    "test": "node --test"
  },
  "dependencies": { "express": "^5.1.0" },
  "devDependencies": { "nodemon": "^3.1.0" }
}

Key points to remember

• Commit package-lock.json; never commit node_modules.
• Use npm ci in CI and deployments — it is faster and honours the lock file exactly.
• The caret ^ allows minor and patch updates; the tilde ~ allows patch only.
• devDependencies are excluded when installing with --omit=dev.

Common mistakes with npm Package Manager

• Adding node_modules to the repository.
• Deleting package-lock.json to "fix" an install, which loses reproducibility.
• Installing a build tool as a runtime dependency, bloating production images.