Every serious application eventually needs code that someone else already wrote well — a date-formatting library, a password-hashing tool, a web framework. Writing all of that from scratch would be wasteful. npm exists to solve exactly this: it's the tool that lets you pull other people's published code into your project, track exactly which versions you depend on, and share the same setup with anyone else who works on the project.
Two things npm actually is
npm is really two things stitched together:
- A command-line tool installed automatically alongside Node.js, used to install, update, and remove packages.
- A public registry — a massive online catalog of open-source JavaScript packages that anyone can publish to and anyone can install from.
package.json — your project's ID card
Every npm-managed project has a package.json file at its root. You generate one with:
npm init -y
The -y flag accepts all the default answers instead of asking you questions one by one. Open the resulting file and you'll see fields like name, version, main (the entry file), and eventually a dependencies section that fills in as you install packages. Think of package.json as a recipe card — anyone who clones your project can run one command and get the exact same ingredients you used.
Installing a package
npm install axios
This does three things: downloads the axios package into a folder called node_modules, adds an entry for it under dependencies in package.json, and records the exact resolved version in a file called package-lock.json (so installs stay reproducible across machines).
A package meant only for development — a testing library, say, not something your app needs once it's running in production — is installed with the --save-dev flag instead:
npm install jest --save-dev
That places it under devDependencies instead of dependencies.
Installing everything a project needs
When you clone somebody else's project, their node_modules folder is never included (it's usually huge and gets regenerated). Instead, you run:
npm install
with no package name — npm reads package.json, figures out every listed dependency, and downloads them all in one go.
Using an installed package
const axios = require('axios');
axios.get('https://api.example.com/data')
.then((response) => console.log(response.data))
.catch((error) => console.error('Request failed:', error.message));
Everyday npm commands
| Command | What it does |
|---|---|
npm install <pkg> | Add a package as a dependency |
npm install <pkg> --save-dev | Add a package as a dev-only dependency |
npm install | Install everything listed in package.json |
npm uninstall <pkg> | Remove a package |
npm update <pkg> | Bump a package to the latest version its range allows |
npm install <pkg>@<version> | Install one specific version |
npm list | Show installed packages in the current project |
Scripts — automating your own commands
package.json also has a scripts section where you can define shortcuts:
"scripts": {
"start": "node server.js",
"test": "jest"
}
Run them with npm start or npm test. For any script name that isn't start or test, you'd type npm run <name> — this small convention saves you from typing out long, easy-to-forget commands every time.