Master package management and node workflows from core CLI usage to advanced publishing and workspaces. Learn how to manage dependencies, handle versioning with SemVer, write custom scripts, configure environments, and publish secure, maintainable JavaScript packages.
Testing a package locally before publishing it is not a single workflow. npm link and npm pack solve different problems, and the choice between them determines whether the test reflects the published artifact or a symlinked approximation of it. Key point: npm link creates a symlink, which means the consumer project sees your working directory…
npm’s configuration system is a layered hierarchy of files, environment variables, and command-line flags. The .npmrc file is the persistent layer: an INI-formatted list of key = value pairs that npm reads at startup. The file exists at four scopes—project, user, global, and builtin—and the values resolve in priority order, with the most specific scope…
A scoped package is a package whose name is prefixed with a namespace, written as @scope/package-name. The scope is the part between the @ and the /, and it groups related packages under a single namespace. Scopes exist to prevent name collisions: a package named utils is unique, but @myorg/utils and @otherorg/utils can coexist because…
An npm workspace is a repository whose root package.json contains a workspaces field listing the directories that hold other package.json files. Running npm install at the root installs every workspace’s dependencies in one pass and symlinks the local packages into the root node_modules, so they can depend on each other without being published to a…
Security in npm operates on two axes: the dependency tree and the credentials that authorize publishing. The dependency tree is audited with npm audit, which compares installed packages against a vulnerability database and offers automated fixes. The credentials are managed as access tokens, which have been consolidated into a single granular model as of November…
Two fields in package.json control dependency resolution when the default behavior does not produce the tree the project needs. peerDependencies declares what a package expects its consumer to provide, and peerDependenciesMeta marks specific peers as optional. overrides forces a specific version of a package anywhere in the dependency tree, including transitive dependencies that the project…
A quick-reference for npm commands, configuration, and dependency resolution. Organized for lookup, not for reading. Core Commands Command Purpose npm init Create package.json interactively npm init -y Create with defaults npm install Install all dependencies npm install <pkg> Install and save to dependencies npm install <pkg>@<ver> Install specific version npm install -D <pkg> Install as…