Node.js NPM

npm (Node Package Manager) is the tool that installs and manages third-party code for Node.js. It comes with Node and connects to the npm registry, which hosts millions of open-source packages, from tiny utilities to full frameworks like Express.

Installing Packages

Packages are downloaded into the node_modules folder, and package.json is updated automatically. Never commit node_modules to Git; anyone can recreate it with npm install.

npm install dayjs          # add a dependency
npm install -D eslint       # add a dev dependency
npm install                 # install everything listed in package.json
npm uninstall dayjs         # remove a package
added 1 package, and audited 2 packages in 1s
found 0 vulnerabilities

Using an Installed Package

import dayjs from 'dayjs';

const launch = dayjs('2026-01-15');
console.log(launch.format('dddd, MMMM D, YYYY'));
console.log('Days until launch:', launch.diff(dayjs('2026-01-01'), 'day'));
Thursday, January 15, 2026
Days until launch: 14

dependencies vs devDependencies

  • dependencies — needed when the app runs in production (express, dayjs).
  • devDependencies — only needed while developing or building (eslint, vitest, typescript).
  • npm install --omit=dev installs production dependencies only, useful on servers.

Semantic Versioning

Versions follow MAJOR.MINOR.PATCH, such as 4.19.2. A major bump may break your code, a minor adds features, and a patch fixes bugs. In package.json, "^4.19.2" allows any 4.x.x update, while "~4.19.2" allows only 4.19.x patches.

package-lock.json records the exact versions that were installed, so every machine gets an identical node_modules. Commit it to Git, and use npm ci on CI servers for clean, reproducible installs.

npm Scripts

// package.json
"scripts": {
  "start": "node src/server.js",
  "dev": "node --watch src/server.js",
  "lint": "eslint .",
  "test": "node --test"
}

$ npm run lint
$ npm test        # start and test do not need "run"
> node-app@1.0.0 lint
> eslint .

npx

npx runs a package's command without installing it globally. For example npx create-vite@latest my-app scaffolds a project, and npx eslint . runs the local ESLint from node_modules/.bin.

Useful npm Commands

  • npm outdated — list packages with newer versions
  • npm update — update within the allowed ranges
  • npm audit — check for known security vulnerabilities
  • npm ls — show the installed dependency tree
  • npm view express version — check the latest published version

Frequently asked questions

What is the difference between npm and npx?

npm installs and manages packages. npx executes a package's binary, downloading it temporarily if it is not installed locally.

Should I commit package-lock.json?

Yes. It locks exact versions so teammates and servers install the same dependency tree, preventing "works on my machine" bugs.

What does the caret (^) mean in package.json?

It allows updates that do not change the major version. ^1.4.0 accepts 1.5.0 or 1.9.3 but not 2.0.0.

Is npm install -g a good idea?

Avoid global installs for project tools. Install them as devDependencies and run them with npm scripts or npx so every developer uses the same version.