npm

npm is the default package manager for Node.js, used to install and share code libraries. Rather than writing every piece of functionality from scratch, developers build software by combining reusable packages of code that others have published. npm is the tool and the online registry that make this possible for the JavaScript world. From the command line, a developer uses npm to pull in the libraries a project needs, to keep them updated, and, if they wish, to publish their own packages for others to use.

Mechanically, npm works together with a file in each project that lists the project's details and its dependencies, the external packages it relies on. When a developer runs the install command, npm reads that list, downloads the required packages from the registry, and places them in a local folder within the project. Because those packages often depend on other packages, npm resolves the whole tree of dependencies automatically. It also records the exact versions installed in a lock file, so that everyone working on the project, and the servers that build and deploy it, get precisely the same code. npm can run project scripts too, such as starting a development server or building the site, which is why its commands appear throughout modern web workflows.

The name is short for node package manager, and the tool was released in 2010 by Isaac Schlueter for the Node.js runtime, the environment that lets JavaScript run outside the browser. Its arrival was pivotal: by giving the JavaScript community a shared, easy way to publish and consume small packages, npm helped fuel an explosion of open-source libraries and became one of the largest software registries in existence. It ships bundled with Node.js, which cemented it as the default choice.

For a business, npm is largely invisible but deeply consequential. It is how development teams assemble sites and applications quickly by standing on existing, tested code rather than reinventing common functionality, which shortens timelines and reduces cost. The lock file it maintains means builds are reproducible, so a site behaves the same in development, in testing, and in production, reducing the class of bugs that come from mismatched environments. Nearly every modern front-end project depends on it in some form.

The common mistakes tend to center on dependencies and security. Pulling in many packages casually can bloat a project and introduce code no one has actually reviewed, and because packages depend on other packages, a single small addition can drag in dozens of others. Since this code runs as part of the application, a compromised or malicious package is a genuine security risk, so teams should keep dependencies updated, remove ones they no longer use, and pay attention to security advisories. Neglecting to commit the lock file undermines reproducibility and invites subtle inconsistencies. npm sits at the center of a wider toolchain, working alongside the general concept of a package manager, feeding the dependencies that bundlers combine, and integrating with the version control and deployment steps that carry code to production.