What npm actually is
npm (Node Package Manager) is the tool that installs, updates, and manages external code libraries — called packages or dependencies — for JavaScript projects. It comes bundled with Node.js, so if you can run node -v in your terminal, you already have npm too.
Starting a new project
This creates a package.json file — the "ID card" of your project. It lists the project's name, version, and every dependency it needs. The -y flag skips the interactive questions and accepts sensible defaults.
Installing a package
This does three things: downloads the package into a folder called node_modules, adds it to your package.json's dependency list, and creates/updates a package-lock.json file that locks the exact versions used.
Dependencies vs. devDependencies
| Type | Command | Used for |
|---|---|---|
| Regular dependency | npm install package-name | Code your app actually needs to run |
| Dev dependency | npm install -D package-name | Tools only needed while building — testing frameworks, formatters |
This distinction matters when you deploy a project — dev dependencies (like testing tools) don't need to ship with your live app, only the regular ones do.
Never commit node_modules
Remember .gitignore from Lesson 2? This is exactly why it exists. node_modules should never be pushed to GitHub — it's huge, and it's fully reproducible from package.json by anyone who runs npm install. Committing it is one of the most common beginner mistakes.
Reinstalling everything on a new machine
This is the first command you run after cloning someone else's project — it reads their package.json and downloads exactly the dependencies they used.
npm scripts: shortcuts for common tasks
Instead of memorizing long commands, projects define short, memorable ones in package.json — this is why you'll often see instructions that just say "run npm start" with no further explanation.
Try it yourself
npm init -y, and open the resulting package.json to see what it contains. Then run npm install lodash and watch the node_modules folder and package-lock.json appear.
Level up: add a script
.gitignore file with node_modules/ inside it. Then add a custom script to your package.json's scripts section, and run it with npm run yourscriptname.
1. What file lists a project's dependencies?
2. Why should node_modules never be committed to Git?
3. What does running npm install with no package name do?
package.json. Never commit node_modules — it's always reproducible with npm install on any machine.