When you take the next step in web development, tutorials suddenly hit you with the incantation npm install. npm is a “delivery service for program parts.” This article untangles what npm is, and what happens the moment you run npm install.
npm is a delivery service that fetches parts
Developers around the world publish handy programs as parts called packages. A part that displays dates nicely, a part that builds a slideshow, whole foundations for a site (like Astro or React)—over two million of them.
npm (Node Package Manager) is the system for fetching and managing these parts with a single command. When you install Node.js, npm comes along with it.
What npm install is doing
When you run npm install in a project’s folder, three things happen.
- It reads
package.json—the file that lists “the parts this project needs” - It downloads the parts—it fetches the listed parts, plus the parts those parts need (the dependencies of the dependencies) all together
- It lays them out in the
node_modulesfolder—the storage spot for the fetched parts
To use an analogy: package.json is the shopping list, npm install is the order button, and node_modules is the pile of delivered boxes.
npm install # fetch everything on the package.json list
npm install astro # additionally fetch the part called astro (it's added to the list too)Why is node_modules so enormous?
When you open node_modules, you’re surprised to find hundreds of folders you don’t remember adding. This is because of the chain of parts needing parts. Even if you asked for just one, that part relies on ten parts, and those ten rely on more—it snowballs.
But there’s no need to be scared. You never touch the contents of node_modules yourself. The pile of boxes is something you leave unopened.
Quick reference for common npm commands
| Command | Meaning |
|---|---|
npm install | Fetch all the parts in package.json |
npm install <name> | Add a part (also appended to the list) |
npm uninstall <name> | Remove a part |
npm run dev | Run the task called dev written in package.json (starting the dev server is the classic case) |
npm -v | Show npm’s own version (handy for a quick check) |
npx <name> | Run a package on the spot without installing it |
When a tutorial says npm run dev, it means “run the task named dev that this project has prepared.” What it actually does is written in package.json’s scripts section.
The last one in the table, npx, is the command to try a part just for the moment without keeping it on your machine. It’s handy when you “only want to use it once,” and it’s not a typo for npm i.
The convenience comes with a catch
npm is also a system for “putting some stranger’s parts on your own PC and running them.” Packages aren’t limited to vetted companies—anyone in the world can publish them, and that’s part of npm’s freedom. Almost all parts are published in good faith, but on rare occasions incidents where a malicious part sneaks in do happen. Let’s also learn the safe habits for when you add parts.
npmnpm's scary story—protecting yourself, learned from the Shai-Hulud incidentThe real Shai-Hulud incident and what beginners can do about it is hereSummary of this lesson
- npm is a delivery service for program parts (packages). It comes bundled with Node.js
npm installreads the package.json shopping list and lays the parts out in node_modules- Don’t touch node_modules, it’s OK to delete, and don’t put it in Git—you can always restore it with npm install
Once you understand what npm install means, you’ve already cleared the first wall in the world’s tutorials.