Node.js NPM

Node.js NPM: Package Management, Dependency Trees & Scripts

NPM (Node Package Manager) is the default package manager for Node.js. It facilitates software module dependency management, semantic versioning (SemVer), and executable automated scripts lifecycle management.

Dependency Resolution & Lockfile Lifecycle

flowchart TD
    A["npm install express"] --> B["Fetch package metadata from Registry"]
    B --> C["Resolve dependency tree in node_modules/"]
    C --> D["Lock exact versions in package-lock.json"]
    D --> E["Update package.json dependencies"]

Manifest File (package.json) Anatomy

{
  "name": "enterprise-api",
  "version": "1.2.0",
  "description": "Production Node.js REST Service",
  "main": "dist/index.js",
  "type": "module",
  "scripts": {
    "start": "node dist/index.js",
    "dev": "node --watch src/index.js",
    "test": "node --test",
    "build": "echo 'Building application production bundle...'"
  },
  "dependencies": {
    "dotenv": "^16.4.5"
  },
  "devDependencies": {
    "@types/node": "^20.11.0"
  },
  "engines": {
    "node": ">=20.0.0"
  }
}

Key NPM Commands Cheat Sheet

# Initialize interactive package.json configuration
npm init -y

# Install production dependency (updates "dependencies")
npm install dotenv

# Install development-only dependency (updates "devDependencies")
npm install -D vitest

# Clean production install matching package-lock.json strictly
npm ci

# Execute defined script in package.json
npm run dev

# Run built-in test runner
npm test

Best Practices & Gotchas

• Commit package-lock.json: Always commit package-lock.json into version control to guarantee identical dependency trees across environments.
• Use npm ci in CI/CD: Use npm ci instead of npm install in deployment builds for fast, deterministic installs that fail if package-lock.json is modified.
• Audit Security Vulnerabilities: Regularly run npm audit and npm audit fix to detect security flaws in installed third-party modules.

Self-Check Challenge

Explain the difference between ^1.2.3 (caret) and ~1.2.3 (tilde) semantic versioning rules in package.json.