npm is two things that share a name: a huge public library of free JavaScript code packages, and the command-line tool that downloads those packages into a project. When a developer needs a date picker, an image resizer or a payment SDK, they usually install it from npm rather than writing it from scratch.
How npm installs and tracks packages
Every project has a package.json file listing its dependencies with allowed version ranges, plus named scripts such as dev, build and test. Running npm install reads that file, fetches each package and all of the packages they depend on, and puts them in a node_modules folder. It also writes package-lock.json, which pins the exact version of every package so another computer gets an identical set.
Version ranges follow semantic versioning: a caret like ^5.2.0 accepts any 5.x release from 5.2.0 up, on the assumption that only a major number change breaks things. npm comes bundled with Node.js and is owned by GitHub. Alternatives such as pnpm and Yarn use the same registry with different install strategies.
An example: adding online payments
A developer adding card payments to a ceramics shop runs npm install stripe for the server and Stripe's browser library for the checkout page. Both entries appear in package.json. Six months later a new developer clones the project from GitHub, runs npm install, and gets the same versions thanks to the lock file. Then npm run build calls the build tool, often Vite, to produce the live files.
When npm affects your business
Your site's code may depend on hundreds of packages written by strangers. Usually that is a strength, since well-used packages are tested by many people. It is also a risk: npm has had real supply-chain incidents where popular packages were hijacked to ship malicious code. If you own a codebase, ask your developer how dependencies are updated and audited.
Common npm mistakes
- Committing
node_modulesto the repository. It is huge and rebuildable from the lock file. - Deleting or ignoring the lock file, so each install can pull different versions.
- Typos in package names. Attackers publish look-alike names hoping someone mistypes.
- Never updating. Run
npm auditandnpm outdatedregularly, then test before upgrading major versions.
Related terms
- Node.js: the runtime npm ships with.
- Repository: where package.json and the lock file are stored.
- Vite: a build tool usually started through npm scripts.
- JavaScript: the language the packages are written in.