Glossary / npm

npm

npm is the default package manager distributed with Node.js. It provides the npm registry client, dependency installation and resolution, package publishing, scripts, workspaces, lockfiles, and security commands. Reliable use requires distinguishing project declarations from the resolved installation tree and choosing commands appropriate for local changes versus automation.

Core project files and commands

package.json declares dependencies and scripts; package-lock.json records the resolved tree. npm install can update the lock when manifests change. npm ci is designed for clean automated installs: it requires a compatible lockfile, removes existing node_modules, fails on manifest/lock mismatch, and does not rewrite the lock. npm run <script> executes a project script with local binaries on PATH. npm exec can run package binaries.

dependencies are needed at runtime; devDependencies are development/build tools; peerDependencies express host compatibility; optionalDependencies may fail installation without failing the whole install, so application code must handle absence. npm v7 and later install peers by default, subject to resolution conflicts. Workspace behavior and CLI details should be checked against the npm major version in use.

Reproducibility and security

Commit the lockfile and use npm ci in CI. Use npm audit to report known advisories, then review remediation rather than blindly applying forceful updates. Install scripts execute package code; configure policy and review dependencies. Use npm explain/npm ls to investigate why a dependency exists, and inspect resolved versions and package integrity metadata.

Engineering guidance

Pin Node/npm policy, keep a single authoritative lockfile, avoid --force as routine conflict resolution, and review dependency changes. Use workspace protocol and commands deliberately. Validate production installs with omitted development dependencies and the target operating system when native or optional packages are involved.

Interview questions

  1. npm install vs npm ci? Install can reconcile and update the lock; ci performs a frozen clean install and requires manifest/lock agreement.
  2. What is a peer dependency for? Declaring compatibility with a host package, common for plugins.
  3. Why can optional dependencies be absent? Installation may proceed after optional package failure or omission.
  4. Does npm audit fix guarantee safe remediation? No; review changes and major-version or range effects.
  5. How trace a transitive dependency? Use npm explain or inspect the dependency tree.

References