What Is npm?
npm and the Node.js Package Registry
npm is the package manager that ships with Node.js. It downloads, installs and updates the libraries a project depends on. The name stands for Node Package Manager, and the same name also refers to the public registry where most Node.js packages are published.
Modern Node.js projects rarely write everything from scratch. A web server might use a framework, a logging library and a database driver, each published as a separate package. Rather than copying their code by hand, the developer lists them as dependencies and npm fetches the matching versions from the registry.
npm packages are either libraries that the application's code imports, or command-line tools that run during development, such as build tools and code checkers. Web frameworks such as Express.js are installed the same way.
The Files npm Creates in a Project
npm works with a few standard files and folders. Knowing what each one does explains most of what happens when a project is deployed:
- package.json lists the project name, its dependencies and named scripts such as build or start. It is written by the developer and kept in version control.
- package-lock.json records the exact version of every installed package, including the packages that other packages depend on. It makes installs repeatable across machines.
- node_modules is the folder where installed packages are stored. It is generated, can be large, and is normally excluded from version control.
On a server, the usual pattern is to upload the project files and install the dependencies from the lock file, so the server matches the development machine.
Alternatives to npm: Yarn and pnpm
Other package managers can work with the same registry and the same package.json format. Yarn and pnpm are the two best-known alternatives. pnpm stores each package once on disk and links it into projects, which saves space. Yarn offers its own lock file and workspace features for managing several packages in one repository.
npm is not the only option, but the choice matters less than consistency. Teams usually pick one tool and use it throughout, because mixing lock files leads to confusing differences between installs. The general ideas behind all of these tools are explained in what a package manager is.
Frequently asked questions
Is npm only used for Node.js?
Mostly yes. npm was built for Node.js, and its registry holds mainly JavaScript packages, including many frontend tools used to build websites. Other ecosystems have their own managers, such as Composer for PHP and pip for Python.
Why is node_modules not uploaded to Git?
The node_modules folder is large and can be rebuilt from package.json and package-lock.json. Committing it bloats the repository, and some packages contain files that only work on a particular operating system. Instead, the project records its dependency list and the developer or server runs an install command to recreate the folder.