Core modules cover the fundamentals, but nobody wants to hand-roll routing logic, database schemas, or authentication from scratch every time. That's where third-party modules come in — code published to npm by other developers, ready to install and use.
Installing one
npm install express
This downloads express into node_modules and records it in package.json. From there, it's used exactly like a core module:
const express = require('express');
const app = express();
app.get('/status', (req, res) => {
res.json({ running: true });
});
app.listen(5000, () => console.log('Server on port 5000'));
A few genuinely widely-used ones, and what they're for
| Package | What it's for |
|---|---|
express | Building HTTP servers and APIs with routing and middleware |
mongoose | Modeling and querying MongoDB data with schemas |
axios | Making HTTP requests to other APIs |
dotenv | Loading configuration from a .env file into process.env |
jsonwebtoken | Creating and verifying auth tokens |
bcrypt | Hashing passwords securely |
Picking a package responsibly
Before installing something, it's worth a quick check on npm's package page: when was it last updated, how many other projects depend on it, does it have open, unaddressed security issues? A package that hasn't been touched in years, or one with only a handful of downloads, is a bigger long-term risk than it looks at first glance — you're trusting its code to run inside your application.
Keeping them updated (carefully)
npm outdated # see which installed packages have newer versions available
npm update # update packages within the version ranges allowed in package.json
A jump in the major version number of a dependency (say 3.x to 4.x) often means breaking changes — worth reading that package's changelog before updating blindly, rather than assuming it's a safe drop-in.
The trade-off to keep in mind
Every third-party module you add is code you didn't write, running inside your application, that you're now responsible for keeping updated and secure. This doesn't mean avoiding them — reusing well-tested community code is one of Node.js's biggest strengths — but it's worth resisting the urge to install a whole package for something five lines of your own code could handle just as well.