npm and Package Managers

A package manager downloads ready-made code (packages) for your project and keeps track of their versions.

What is a Package?

A package is code written by someone else that you can reuse: a date formatter, a slider, a whole framework like React. Instead of copying files by hand, you ask a package manager to install it.

Language	Package manager	Package website
JavaScript / Node.js	npm (also yarn, pnpm)	npmjs.com
Python	pip	pypi.org
PHP	Composer	packagist.org
C# / .NET	NuGet	nuget.org

This lesson uses npm, which comes with Node.js.

Install Node.js and npm

Download the LTS version of Node.js from the official Node.js website and install it. Then check both commands:

Example

bash

node -v
npm -v

Output

v22.11.0
10.9.0

Start a Project

Example

bash

mkdir price-app
cd price-app
npm init -y

This creates package.json, the file that describes your project:

Example

json

{
  "name": "price-app",
  "version": "1.0.0",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "license": "ISC"
}

Installing Packages

Example

bash

npm install dayjs

Output

added 1 package, and audited 2 packages in 1s

found 0 vulnerabilities

Three things happened:

The package was downloaded into the node_modules folder.
package.json got a new dependencies section with "dayjs": "^1.11.13".
package-lock.json recorded the exact versions installed.

Now use it in index.js:

Example

javascript

const dayjs = require("dayjs");

const admission = dayjs("2026-10-15");
console.log("Classes start on " + admission.add(7, "day").format("DD MMM YYYY"));

Example

bash

node index.js

Output

Classes start on 22 Oct 2026

Common npm Commands

Command	What it does
`npm install`	Install everything listed in package.json
`npm install name`	Add a package your app needs
`npm install -D name`	Add a development-only tool (tests, linters)
`npm uninstall name`	Remove a package
`npm update`	Update packages within allowed versions
`npm run name`	Run a script from package.json
`npm outdated`	Show packages with newer versions
`npx name`	Run a package's command without installing it globally

node_modules and Git

node_modules can contain thousands of files. Never commit it to Git. Add it to .gitignore. Anyone who clones your project runs npm install, and npm rebuilds it from package.json and package-lock.json.

Do commit package-lock.json. It makes sure everyone on the team, and your hosting server, installs exactly the same versions.

Scripts

The scripts section gives short names to commands:

Example

json

{
  "scripts": {
    "start": "node index.js",
    "dev": "node --watch index.js"
  }
}

Example

bash

npm run dev

Almost every modern project uses scripts like npm run dev, npm run build and npm test. Check package.json first when you open someone else's project.

Version Numbers

Versions follow major.minor.patch, like 1.11.13.

^1.11.13 allows updates up to (but not including) 2.0.0
~1.11.13 allows only patch updates, up to 1.12.0
1.11.13 means exactly this version

A major version change (1 to 2) can break your code, so npm does not do it automatically.

yarn and pnpm

yarn and pnpm are other package managers that use the same npm registry. pnpm saves disk space and is fast. Commands are similar: pnpm add dayjs, yarn add dayjs. Use whatever the project already uses; you can tell from the lock file (package-lock.json, yarn.lock or pnpm-lock.yaml).

Exercise

You cloned a project from GitHub. Which command installs all its packages?

npm installnpm init -ynpm run devnode index.js