Node Package Manager (NPM) and package.json

Manage dependencies and repeatable commands with npm

package.json describes a Node project, its module format, dependencies and command shortcuts. package-lock.json records a resolved dependency tree. node_modules contains installed files and can be recreated. A reproducible project commits the manifests and lockfile, rather than copying a developer's node_modules folder.

Create a small API package

mkdir exam-api
cd exam-api
npm init -y
npm install express@5

In package.json, retain npm's generated dependency entry and add the following fields. JSON uses double quotes, has no comments and does not allow trailing commas.

{
  "name": "exam-api",
  "version": "1.0.0",
  "private": true,
  "type": "module",
  "scripts": {
    "start": "node server.mjs",
    "dev": "node --watch server.mjs",
    "test": "node --test"
  }
}

This fragment illustrates the fields to merge; do not delete the dependencies that npm installed. private prevents accidental npm publication. It does not hide a repository or protect secrets. Create server.mjs containing console.log('API starting'); then run npm start. npm run dev restarts the process when watched source files change on supported Node releases. npm test runs tests discovered by Node's test runner.

Choose the right install command

Use npm install when adding or updating packages during development. Use npm ci in a clean automated build when package.json and the lockfile are already committed: it expects them to agree and replaces the existing node_modules installation. npm install --save-dev adds a development tool. A package needed at runtime belongs in dependencies, not only devDependencies.

Read versions and inspect changes

A caret range such as ^5.0.0 permits compatible updates below the next major version; the lockfile pins the actual resolved installation. A major version may change behavior. Review changelogs and run your checks before deployment. Use npm ls --depth=0 to see top-level installed packages and npm outdated to inspect available updates.

Security and repository hygiene

Dependencies and lifecycle scripts execute code on your machine. Check package names, maintainers and official installation instructions before adding a package. npm audit reports known dependency advisories; review the affected code paths and proposed upgrades. Do not automatically use a force fix that introduces unreviewed major changes. Never put passwords, database URLs or JWT secrets into package.json or committed .env files.

Practice checkpoint

Add a check script that runs node --check server.mjs. Run npm run check, introduce a syntax error, and observe a nonzero exit. Explain why a teammate needs package-lock.json, and why a missing runtime dependency can work locally but fail in a production-only install.