---
title: "npm"
description: "npm is the package manager for Node.js and the largest JavaScript library registry. Learn about package.json, dependencies and how npm and yarn compare."
url: "https://nodea.io/en/glossary/npm"
lang: "en"
updated: "2026-07-13"
---

# npm

> npm (Node Package Manager) is the default package manager for the Node.js environment and the world's largest registry of JavaScript libraries. It manages project dependencies via the package.json file.

**npm** (Node Package Manager) is the default package manager for the [Node.js](https://nodea.io/en/glossary/node-js) environment and the world's largest registry of open-source [JavaScript](https://nodea.io/en/glossary/javascript) libraries. It lets you install, update and publish code packages and manage a project's dependencies. For most web applications and front-end tooling it is part of a developer's daily toolkit.

## How npm works

At the heart of an npm-based project is the **package.json** file, which describes the application and lists its dependencies along with acceptable version ranges. The *npm install* command reads this file, downloads all required packages (and their dependencies) from the registry and places them in the *node\_modules* directory. It also produces a *package-lock.json* file that records the exact versions, so installations are reproducible across machines and environments.

Beyond installation, npm also acts as a script runner — the *scripts* section of package.json lets you define commands such as *npm run build* or *npm run dev* that automate building, testing and running the project. This ties npm into the whole development process alongside tools like [Webpack](https://nodea.io/en/glossary/webpack) and transpilers.

## Practical application

npm is used in virtually every modern front-end project and many back-end ones. Installing a framework (React, Vue), a UI library, a linter or a testing suite comes down to a single command. Dependencies are kept out of the [Git](https://nodea.io/en/glossary/git) repository — only package.json and the lockfile are versioned, while node\_modules is recreated by the install command.

Alternatives to npm include [Yarn](https://nodea.io/en/glossary/yarn) and pnpm, which use the same package registry but offer different caching and installation strategies. It is worth maintaining dependency hygiene: running regular security audits with *npm audit* and keeping packages updated, since vulnerabilities in third-party libraries are a real attack vector against applications.

### How does npm differ from yarn?

Both tools manage JavaScript dependencies and draw from the same npm registry. Yarn appeared as a faster, more deterministic alternative to early npm versions, introducing a lockfile and better caching. Modern npm has closed most of the gap, so the choice today is largely a matter of team preference.

### What is the package.json file?

package.json is a Node.js project's configuration file that describes its name, version, run scripts and list of dependencies with version ranges. Based on it, the npm install command downloads and installs all required packages into the node\_modules directory, recreating the project environment on any machine.

## Related

- [Node.js](https://nodea.io/en/glossary/node-js)
- [JavaScript](https://nodea.io/en/glossary/javascript)
- [Yarn](https://nodea.io/en/glossary/yarn)
- [Webpack](https://nodea.io/en/glossary/webpack)
- [Git](https://nodea.io/en/glossary/git)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/npm.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)