# npm Explained: The Package Manager Behind JavaScript

## Introduction

Almost no JavaScript project is written from scratch: you build on libraries — React, Express, lodash — written by other people. npm (Node Package Manager) is how those libraries reach your project: it is both the world's largest software registry (millions of packages) and the command-line tool that installs and manages them. If you use Node.js (the Node.js post), you already have npm.

## Install: dependencies, and where they live

Installing a package is one command:

```bash
npm install react
```

That downloads React into `node_modules/` and records it in `package.json`, the manifest every JavaScript project carries:

```json
{
  "dependencies": {
    "react": "^18.2.0"
  }
}
```

The caret means "compatible updates allowed" — version 18.3 is fine, 19.0 is not. Development-only tools (test runners, linters like ESLint) go in `devDependencies` instead, so production installs skip them. And `node_modules/` itself is never committed to Git — it can contain tens of thousands of files — which is why a fresh clone starts with `npm install` and rebuilds it.

## Scripts and the lockfile: the two files that save teams

`package.json` also holds scripts — named commands that standardise how a project runs:

```json
{
  "scripts": {
    "start": "node server.js",
    "test": "jest",
    "build": "webpack"
  }
}
```

Now `npm test` means the same thing on every machine, for every developer. The other lifesaver is `package-lock.json`: it records the exact version of every package and every transitive dependency (dependencies of dependencies) that was installed. Without it, two developers installing on different days could get different versions and different bugs; with it, installs are reproducible. Commit the lockfile, always — it is the difference between "works on my machine" and "works everywhere."

## The honest trade

npm's scale is also its risk: the registry's openness means supply-chain attacks (a compromised package) are a real concern, which is why teams audit dependencies and lock versions. And `node_modules` bloat is legendary — a small project can pull in hundreds of transitive packages. Alternatives like Yarn and pnpm exist and improve on speed and disk usage, but npm remains the default, and its concepts (manifest, lockfile, scripts, registry) are shared by every package manager in every language.

## Takeaway

npm installs packages into `node_modules`, records them in `package.json`, standardises commands with scripts, and guarantees reproducibility with the lockfile. It is the unglamorous infrastructure that makes modern JavaScript's reuse possible — and the lockfile is the single habit that saves the most team arguments.

Originally published at https://practicaldevblog.blogspot.com/2026/10/npm-explained-package-manager-behind.html