npm (Node Package Manager) is a command-line tool and public registry for downloading, publishing and managing JavaScript packages. A project lists its dependencies in package.json and installs them into a node_modules folder.
Why it matters
Almost every modern web project depends on dozens or hundreds of packages, directly or through other packages. That speeds up development and introduces supply-chain risk, because a compromised or abandoned package affects your build. A lock file records exact versions so every install is reproducible. Pinning versions and reviewing updates keeps a surprise dependency change from taking your build or site down.
Example
$ npm install express
$ npm run build
The first command adds express to dependencies in package.json and updates package-lock.json. The second runs the script named build defined in the same file.
Common mistakes
- Not committing the lock file, so builds differ between machines.
- Running
npm audit fix --forceblindly, which can introduce breaking upgrades. - Committing the
node_modulesfolder to version control.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.