npm Basics for Beginners

If you have installed Node.js, you already have npm (Node Package Manager), the default tool for installing, sharing, and managing JavaScript packages. Beyond downloading libraries, it manages dependencies, records their versions, and provides scripts for tasks such as starting a server or running tests.

What Is a Package?

A package is a reusable piece of code, bundled with a description of what it does and which other packages it needs. Packages are published to the npm registry, a large public collection that anyone can search. Popular examples include Express for building servers, lodash for utility functions, and chalk for coloured terminal output.

Using packages saves time, but it creates dependencies: your project relies on code you did not write, so choose well-maintained packages and keep the list tidy. A dependency is needed to run the project (e.g. a web framework); a dev dependency is only needed while building it (e.g. a testing tool).

Checking npm and Starting a Project

First, confirm that npm is installed:

npm --version

You should see a version number; if not, reinstall Node.js. To start a project, create a folder, move into it, and run:

npm init -y

This creates package.json with default settings (-y accepts all defaults; without it, npm asks about name, version, and entry point). You can edit it by hand later.

A typical package.json looks like this:

{
  "name": "my-first-project",
  "version": "1.0.0",
  "main": "index.js",
  "scripts": {
    "start": "node index.js"
  },
  "dependencies": {},
  "devDependencies": {}
}

The scripts section defines shortcuts run with npm run — e.g. npm start runs the start script above. Many projects add scripts for a dev server, tests, or builds.

Installing Packages

To install a package and add it to your dependencies, run:

npm install express

You can also write npm i express as a shortcut. After installation, Express appears in the dependencies section of package.json, and its files are downloaded into a folder called node_modules.

To install a package as a dev dependency, add the –save-dev flag:

npm install --save-dev nodemon

Nodemon is a good example of a dev dependency: it restarts your server automatically when files change, which is helpful during development but not needed when the app is running in production.

To use an installed package in your code, require it just like a built-in module:

const express = require("express");

If a module cannot be found, it was usually never installed, you are in the wrong folder, or node_modules was deleted — running npm install in the project folder usually fixes it.

Understanding package.json and package-lock.json

package.json lists needed packages with version ranges: “express”: “^4.18.2” means any version compatible with 4.18.2, where the caret ^ allows minor and patch updates. package-lock.json records the exact versions installed, including dependencies of dependencies, making installs reproducible for other developers or servers. Commit both files to Git, but not node_modules — it can contain thousands of files and is recreated by npm install, so most projects add it to .gitignore.

Updating and Removing Packages

Over time, packages release new versions with fixes and features. To check which of your packages are out of date, run:

npm outdated

This shows the current version, the version your package.json allows, and the latest available version. To update a package within the allowed range, run:

npm update express

To install a specific version, include it in the install command:

npm install express@4.18.2

To remove a package, run:

npm uninstall express

This removes the package from node_modules and from package.json. If you remove a package that other code still requires, you will see a “cannot find module” error the next time you run the project, so check your imports after uninstalling.

Update deliberately: read release notes for major versions, since they may break code, and test after updating in production projects.

Running Scripts and Using npx

For example:

{
  "scripts": {
    "start": "node index.js",
    "dev": "nodemon index.js",
    "test": "node --test"
  }
}

Run these with npm start, npm run dev, and npm test (start and test have shortcuts; other scripts need npm run). You may also see npx: while npm installs packages, npx runs a package without installing it permanently. For example:

npx create-react-app my-app

This is handy for scaffolding tools and one-off commands, but for packages your code imports, use npm install instead.

Common Beginner Mistakes

Do not install globally with -g when a local install will do: global installs are for command-line tools used everywhere, while libraries your project imports should be local so the project works on other computers. Always check you are in the folder containing package.json before installing — a surprise new package.json means you were in the wrong directory. Finally, avoid unneeded packages: each adds code to review, update, and trust, so check documentation, downloads, and recent maintenance first.

Conclusion

npm is more than a download tool: it manages your project’s dependencies, records exact versions, and provides scripts for everyday tasks. Start with npm init, install packages locally, keep an eye on package.json and package-lock.json, and do not commit node_modules. With those habits in place, you will find it much easier to build Node.js projects, follow tutorials, and collaborate with other developers.