Lesson 26 · JavaScript beyond the browser

npm and packages

npm is the package manager that comes with Node.js. Follow one real install, npm install ms, from the registry into node_modules: package.json saves the version range ^2.1.3, package-lock.json pins the exact version 2.1.3 with a hash, npm start runs a script, require("ms") finds the package by name, and npm ci rebuilds the folder exactly on another machine.

11 min10 steps5 questionsAdvanced

Fig 26 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01package.json says "ms": "^2.1.3". Which of these versions would that range allow?

The caret allows any version from 2.1.3 up to, but not including, 3.0.0. So 2.4.0 would be allowed if it existed (ms has no 2.4.0 yet); 2.1.2 is too old and 3.0.0 is a new major version.

02What does package-lock.json record that package.json does not?

package.json holds the allowed range. The lock file pins the exact version (2.1.3), the tarball URL and a sha512 hash, so every install gets the same bytes.

03In index.js, require("ms") runs. Where does Node look for ms?

"ms" is a bare name, not a path, so Node looks in node_modules folders, nearest first. In node_modules/ms it reads package.json's main field to find index.js. require never downloads anything.

04package.json has "scripts": { "start": "node index.js" }. What does npm start do?

npm start runs the command saved under scripts.start. Scripts give everyone on the project the same short name for a job.

05A teammate clones your project, which has package.json and package-lock.json but no node_modules. What should they run to get exactly your versions?

npm ci deletes any node_modules and installs exactly what the lock file lists. It stops with an error if package.json and the lock file disagree, and never changes either file.

Key terms

Glossary

Package: A folder of reusable code described by its own package.json, which gives at least its name and version.
npm: The package manager installed with Node.js. It installs, updates and publishes packages and runs project scripts.
npm registry: The public online database of packages at registry.npmjs.org that npm downloads from.
node_modules: The folder in your project where npm puts installed packages. Node's require looks here for a package by name.
package.json: Your project's description: name, version, scripts and the dependencies it needs, with allowed version ranges.
package-lock.json: The file npm writes with the exact version, source and integrity hash of every installed package.
Semantic version: A MAJOR.MINOR.PATCH version such as 2.1.3. A new major version may break code that used the old one.
Caret range: A range such as ^2.1.3 that allows newer minor and patch versions (from 2.1.3 up to, not including, 3.0.0).

Fine print

Notes and sources

npm init -y also writes description, main, keywords, author, license, type and a placeholder test script; the card shows only the fields this lesson uses, and npm writes each object over several lines.
npm install ms is short for npm install ms@latest. ms also has beta, canary and nightly tags pointing at 3.x and 4.x pre-releases; npm installs those only if you ask for them by name or tag.
The lock file also lists your own project under the key "" and gives the full tarball URL and the full 88-character sha512 hash; the card cuts them short.
ms's own package.json lists devDependencies (its test tools). Those are installed only when you work on ms itself, not when you install ms as a dependency.
require is Node's CommonJS module system. With "type": "module" in package.json you would write import ms from "ms", the standard ECMAScript import; Node finds the package in node_modules the same way.
npm start first prints the script's name and command (> hello-npm@1.0.0 start, > node index.js), then the program's output.
One npm install ms writes the dependency into package.json and writes package-lock.json in the same run; the lesson shows them as two steps to explain each file.
node_modules is usually listed in .gitignore, so it is never committed: package.json and package-lock.json are enough to rebuild it.

Quiz Unlocks after the last step.