How to Use NPM for JavaScript Package Management

NPM (Node Package Manager) is the default package manager for the JavaScript and Node.js ecosystem. With NPM, you can install thousands of open-source libraries in a single command, manage project dependencies, and run build automation scripts. Almost every modern JavaScript project — from React and Vue to Express — relies on NPM in its workflow.

Installing NPM

NPM is included when you install Node.js. Download Node.js from https://nodejs.org and choose the LTS version. Verify both are installed:

node --version
npm --version

Starting a New Project

Initialize a new project by creating a package.json file:

npm init

An interactive wizard will ask for the project name, version, description, and more. Use the -y flag to skip all the questions and use the default values:

npm init -y

Installing Packages

Install a package and save it as a main project dependency:

npm install express
npm install axios react react-dom

The package will be downloaded to the node_modules/ folder and recorded in package.json and package-lock.json.

For packages needed only during development (testing, bundler, linter):

npm install --save-dev webpack webpack-cli
npm install -D eslint prettier

To install a package globally (available across the entire system):

npm install -g nodemon
npm install -g create-react-app

Understanding package.json

The package.json file is the core of an NPM project:

{
  "name": "my-project",
  "version": "1.0.0",
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "build": "webpack --mode production",
    "test": "jest"
  },
  "dependencies": {
    "express": "^4.18.0",
    "axios": "^1.6.0"
  },
  "devDependencies": {
    "nodemon": "^3.0.0",
    "webpack": "^5.0.0"
  }
}

Running NPM Scripts

Scripts in package.json make it easy to automate common tasks:

npm start
npm run dev
npm run build
npm test

The start and test commands can be run directly without the word run. For other custom scripts, use npm run script-name.

Installing All Dependencies from package.json

When you clone a project or a teammate adds a new package, run:

npm install

NPM will read package.json and download all dependencies that aren't present yet.

Updating and Removing Packages

See which packages already have a newer version:

npm outdated

Update packages to the latest compatible version:

npm update

Remove a package that's no longer needed:

npm uninstall package-name

Frequently Used NPM Commands

• npm install — Install all dependencies from package.json.
• npm install package-name — Add a new package.
• npm install -D package-name — Add as a devDependency.
• npm uninstall package-name — Remove a package.
• npm list — Show all installed packages.
• npm audit — Check for security vulnerabilities in dependencies.
• npm audit fix — Automatically fix vulnerabilities when possible.
• npm cache clean --force — Clear the NPM cache if there are installation problems.

Files You Shouldn't Commit

The node_modules folder can be very large (hundreds of MB). Add it to .gitignore:

node_modules/

The package.json and package-lock.json files must be committed. The package-lock.json file ensures all developers and servers use the exact same package versions.

Conclusion

NPM is a fundamental tool that every JavaScript developer must master. By understanding how to install packages, write scripts, and maintain package.json well, you're ready to work on almost any modern JavaScript project. Don't forget to always commit package-lock.json, ignore the node_modules folder, and regularly run npm audit to keep your project's dependencies secure.