Skip to content

npm

npm installs the JavaScript packages a project depends on and can run commands the project defines.

Visit npm

What does npm do when you start a JavaScript project?

The npm command installs packages and runs project scripts. The npm registry is one place it can get those packages. Node.js runs the JavaScript used by npm, build tools and many server apps.

For an existing project, start in the project folder and read its setup instructions. Check the Node.js and npm versions separately. If the project names another manager, follow that choice even if npm already came with Node.js.

Why are package.json and package-lock.json both there?

package.json describes the app’s dependencies and named commands. package-lock.json records the package versions npm resolved, including packages your direct dependencies bring in.

A version range in the manifest says what the project can accept. The lockfile says what was selected. When you intentionally add or update a dependency in a trusted project, review both files together. Keep the lockfile with the code so other machines can recreate that dependency selection.

How can you learn what npm would use without installing a package?

Use two short, made-up files in a new local folder and open them as text. You can learn what the manifest and lockfile record without running commands from the project.

  1. Write a fictional dependency requirement
    On paper or in a new folder outside your project, write that package.json allows demo-widget at ^1.2.0. Treat demo-widget as a fictional name. Do not look it up or install it.
  2. Write the selected version beside it
    Sketch package-lock.json showing version 1.2.4 for that dependency. Circle the range and underline the resolved version. If someone changes the requirement to ^2.0.0, the old selection no longer fits.
  3. Read the script before you use it
    A command such as npm run build follows the build entry in package.json. Inspect the command it names and any related pre or post scripts in a real project before running them. The paper exercise runs none of them.

Why might npm ci fail even if npm install worked?

npm ci needs a lockfile that agrees with package.json. It can recreate the installed packages in an automated check without rewriting the manifest or lockfile, and it removes an existing node_modules directory first.

Compare the committed manifest, lockfile, Node.js/npm versions and install options if local and automated installs disagree. Keep required nonsecret configuration with the project, and provide private registry access separately. Install-time scripts can run code. Review them before installing or rebuilding dependencies from an unfamiliar project.