Master package management and node workflows from core CLI usage to advanced publishing and workspaces. Learn how to manage dependencies, handle versioning with SemVer, write custom scripts, configure environments, and publish secure, maintainable JavaScript packages.
npm lifecycle scripts are hooks that run automatically at specific points in a package’s lifecycle—during install, pack, publish, or when a user-defined script is invoked. The pre and post prefixes are the general mechanism: any script named prefoo runs before foo, and postfoo runs after it . The special scripts prepare, prepublishOnly, and the deprecated…
Environment variables are the mechanism by which npm scripts receive configuration that varies by machine, by environment, or by deployment target. A script that reads process.env.NODE_ENV or process.env.API_URL is not hardcoded to a single setup; it adapts based on what the surrounding shell or .env file provides. The complication is that setting environment variables in…
Package maintenance is not a single command but a cycle. npm update advances dependencies within the semver ranges declared in package.json. npm audit inspects the dependency tree for known vulnerabilities and optionally applies fixes. npm uninstall removes a package and cleans up every reference to it. Each command modifies a different artifact—node_modules, package-lock.json, or package.json—and…
An npm account is the credential that separates a consumer of packages from a publisher. Creating one takes minutes, but the account that can actually publish is a different thing from the account that was just created. Publishing to the public registry requires two gates to be cleared: email verification and two-factor authentication . The…
A published package is consumed by many different resolvers: Node.js in CommonJS mode, Node.js in ESM mode, TypeScript with legacy module resolution, TypeScript with modern bundler or node16 resolution, and bundlers like Vite and Webpack. Each resolver looks at package.json differently. The four fields that determine whether a package works across all of them are…
Publishing a package to the npm registry involves a decision that is easy to get wrong: which files from the project directory end up in the published tarball. Three mechanisms compete for this decision—.gitignore, .npmignore, and the files field in package.json—and their precedence rules are not intuitive. A .gitignore entry that excludes a secrets file…
Version management is the discipline of incrementing a package’s version number in a way that communicates the nature of the change to the consumers who depend on it. The npm version command automates this increment, writing the new version to package.json and package-lock.json, and—when run inside a Git repository—creating a commit and a tag that…
Publishing a package to the npm registry is a single command, but the result depends on a decision made before the command runs: is the package scoped or unscoped, and is the account paid or free? The npm publish command reads the package name in package.json and applies a default access level based on whether…
Distribution tags (dist-tags) are human-readable labels that point to specific versions of a published package. The latest tag is the one npm uses by default when a consumer runs npm install package-name without a version or tag specifier. Every other tag—next, beta, stable, canary—is a custom pointer that the publisher creates and manages. The npm…
Package lifecycle management extends beyond publishing. A maintainer eventually faces one of three decisions: remove a package entirely, mark it as no longer recommended while keeping it installable, or hand it to someone else. npm provides a distinct command for each, and the registry’s policies determine which commands are even permitted. The default recommendation from…