npm

npm means Node Package Manager. Isaac Schlueter opened it in 2010 alongside Node.js. A package is ready code that someone else wrote. package.json keeps the project's name and the package list. npm install reads that list and puts the packages in the node_modules folder. package-lock.json pins the exact version, so the same code arrives on another machine tomorrow. Yarn and pnpm do a similar job, but they are not npm itself.

npm is for adding a library to a project, starting a script with one command, and giving a package to someone else.

• Installing React and another library
• Opening the test with npm test
• Setting up the project on another computer with the same packages
• Sending your own package to the registry

With npm you add a package, remove an old one, and run the script in package.json. It does not draw the page itself and it does not build the server. The code inside the package runs in your project. Installing a package you do not know can also run its command.

Installing one package is easy. The difficulty is the version and the permission. A package also brings another package. If one of them is old, a warning appears, but the project may still run. Throwing away the package-lock file can bring another version tomorrow. Do not write a registry token into the repo.

Advantage: a library is not rewritten, the list stays in one file, and the same install repeats on another machine. Limit: node_modules grows. Not every small job needs a package. npm is not Node.js itself.

A package has a name and a version. package.json is the list. node_modules is the place of the downloaded files.

• dependencies are for the project to run
• devDependencies are only for preparing it
• scripts tie a command to a short name
• The lock file keeps the version

This line adds the React package to the project's list and downloads the files. It does not write React itself.

npm install react

• Are npm and Node.js the same? No. Node.js runs the program. npm brings the package.
• Is package.json the package itself? No. It is the list. The package file is inside node_modules.
• Is every package safe? No. A package you do not know can run its own command.