Master package management and node workflows from core CLI usage to advanced publishing and workspaces. Learn how to manage dependencies, handle versioning with SemVer, write custom scripts, configure environments, and publish secure, maintainable JavaScript packages.
npm is the package manager for the Node JavaScript platform. Its job is to put modules in place so that Node.js can find them, and to manage the dependency conflicts that arise when different packages require different versions of the same library . The name originally stood for “Node Package Manager,” and it refers to…
Node.js and npm are installed together, but they are versioned separately. Node.js ships with a specific npm version bundled into each release—Node.js 24.19.0 includes npm 11.17.0, for example—and npm releases new versions more frequently than Node.js does . This means the npm you have is not necessarily the latest npm, even if your Node.js is…
Every Node.js project begins with a package.json file. It is the manifest that records the project’s name, its version, its scripts, and the dependencies it needs. Creating that file by hand is possible but error-prone: a missing name, a version that does not follow semantic versioning, or a typo in the scripts key produces a…
The package.json file is the single most important file in a Node.js project. It is the manifest that tells npm what the project is, what it depends on, and how to run it. Every npm install, npm run, and npm publish reads this file. The npm documentation describes it as “the whole interface” to npm—without…
Every package you install with npm lands in one of two places in your package.json: dependencies or devDependencies. The distinction is not cosmetic. It determines whether the package is installed when you build for production, whether it is shipped in your deployment artifact, and whether your production server can actually run the code after deployment….
Semantic Versioning is a formal specification for how version numbers are assigned and incremented. It exists because version numbers without a shared meaning are useless for dependency management: a consumer cannot look at 2.4.1 and know whether upgrading to 2.5.0 is safe, or whether 3.0.0 will break their code. SemVer solves this by tying each…
The two files serve opposite purposes in the same dependency system. package.json is the manifest: it declares the project’s metadata, scripts, and the ranges of acceptable dependency versions. package-lock.json is the resolution: it records the exact version of every package that was actually installed, including transitive dependencies that package.json never mentions. The distinction matters because…
npm installs packages in two locations, and the flag determines which one. A local install, the default, places the package in the node_modules folder of the current project and records it in package.json. A global install, triggered by -g or –global, places the package in a system-wide location (/usr/local/lib/node_modules on most Unix systems) and makes…
npx is the command that resolves the tension between local and global installation. It runs a package’s binary without requiring a permanent install, checking first in the local node_modules/.bin, then in the npm cache, and downloading temporarily only if the binary is not found anywhere . The command ships with npm since version 5.2.0, so…
An npm script is a named shell command stored in package.json and executed by npm with a modified environment. The modification is the point: npm prepends node_modules/.bin to the PATH before running the script, so any binary provided by a locally installed dependency can be invoked by name without the full path . This is…