NPM & package.json

Last Updated : Oct 2026

NPM is a package manager for Node.js. It allows you to install and manage dependencies for your Node.js projects.

Almost every Node.js project relies on NPM (Node Package Manager).The heart of every Node project is the package.json file. It acts as a manifest that tracks project metadata, dependencies, and custom terminal scripts.

NPM is two things:

An online registry containing over a million open-source JavaScript packages.
A Command Line Interface (CLI) tool installed automatically alongside Node.js.

Initializing a Project (package.json)

To generate a package.json file, run:

npm init -y

(The -y flag skips the interactive setup prompts and accepts sensible default values.)

Anatomy of a standard package.json:

{
  "name": "project-name",
  "version": "1.0.0",
  "type": "module",
  "main": "index.js",
  "scripts": {
    "start": "node index.js"
  },
  "dependencies": {},
  "devDependencies": {}
}

dependencies (Production Dependencies )

dependencies are the packages your project requires to run in production. (e.g., Express web framework, database drivers, JWT auth tools).

Syntax:

npm install package-name
# or
npm i package-name
# or
npm add package-name
# or
npm i package-name@version # To install a specific version

e.g.

npm install express

devDependencies (Development Dependencies)

devDependencies are the packages your project requires to run in development. (e.g., linting tools, testing frameworks).

Syntax:

npm install -save-dev package-name
# or
npm i -D package-name

e.g.

npm install -save-dev nodemon

Global Dependencies (Global Dependencies)

globalDependencies are the packages your project requires to run in any environment. (e.g., CLI tools, package managers).

Syntax:

npm install -g package-name
# or
npm i -g package-name

e.g.

npm install -g nodemon

Uninstalling Dependencies

Syntax:

npm uninstall package-name
# or
npm remove package-name
# or
npm rm package-name
# or
npm un package-name

Common Flags

Flags are optional arguments that modify the behavior of a command. it is case sensitive.

-save: Adds a dependency to dependencies in package.json.
-save-dev: Adds a dependency to devDependencies in package.json.
-D: Same as -save-dev.
-S: Same as -save.
-g: Adds a dependency to globalDependencies in package.json.
-i: install package.
-y: Skip the interactive setup prompts and accept sensible default values.

package-lock.json & Versioning

When you install a package, NPM generates or updates a package-lock.json file alongside package.json.

package.json: Specifies acceptable version ranges using Semantic Versioning (SemVer) syntax (e.g., ^1.2.3).
package-lock.json: Records the exact, immutable version tree installed in your node_modules folder to guarantee everyone on your team installs the exact same dependencies.

Semantic Versioning (SemVer) Breakdown (MAJOR.MINOR.PATCH)

^1.4.2
| | |
| | +--> PATCH: Bug fixes (1.4.3) - Safe
| +----> MINOR: New features, backward-compatible (1.5.0) - Safe
+------> MAJOR: Breaking changes (2.0.0) - Requires manual review

Caret (^1.4.2): Updates to the latest MINOR or PATCH versions automatically (1.5.0 allowed, but NOT 2.0.0).
Tilde (~1.4.2): Updates ONLY to the latest PATCH versions (1.4.3 allowed, but NOT 1.5.0).
Exact (1.4.2): Locks the package to that specific version only.
* : Locks the package to the latest version available.

Custom Scripts in package.json

To add custom scripts to your package.json, add them to the scripts object:

"scripts": {
  "start": "node index.js",
  "dev": "nodemon index.js",
  "check-sys": "node osDemo.js"

}

Running Scripts

Built-in lifecycle commands (start, test):

npm start

Any custom script name (dev, check-sys):

npm run dev

Most Common NPM Modules

express: Node.js web framework.
nodemon: Node.js development server.
body-parser: Middleware for parsing HTTP request bodies.
cors: Middleware for enabling CORS (Cross-Origin Resource Sharing).
multer: Middleware for handling multipart/form-data requests.
dotenv: Loads environment variables from a .env file.
jsonwebtoken: Creates and verifies JSON Web Tokens.
bcrypt: Password hashing and salting for Node.js.
socket.io: Real-time web framework for Node.js.
mongoose: MongoDB object modeling for Node.js.
mysql2: Node.js driver for MySQL.
pg: Node.js driver for PostgreSQL.
nodemailer: Email sending library for Node.js.

Report An Issue

← Previous Next →