npm basics

npm (Node Package Manager) installs dependencies, runs scripts, and publishes packages. Every serious Node project starts with npm init and a package.json manifest.

Essential files

• package.json — name, version, scripts, dependencies
• package-lock.json — exact dependency tree for reproducible installs
• node_modules/ — installed packages (usually gitignored)

Common commands

• npm install — install from lock file
• npm install express — add dependency
• npm run dev — run script from package.json
• npm audit — report known vulnerabilities

Scripts example

"scripts": {
  "start": "node src/main.mjs",
  "dev": "node --watch src/main.mjs",
  "test": "node --test"
}

Playground note

The runner cannot npm install arbitrary packages—lessons simulate manifests in comments and use built-ins in runnable code.

Important interview questions and answers

1. Q: package.json vs package-lock.json?
   A: JSON declares semver ranges; lock pins exact versions—commit lock in apps for CI reproducibility.
2. Q: dependencies vs devDependencies?
   A: Runtime vs build/test-only tools (eslint, jest)—production installs can omit dev with npm ci --omit=dev.

Self-check

1. Why commit package-lock.json?
2. What folder holds installed packages?