npm Basics | JavaScript Lesson

Lesson content

Read, practise, then check your understanding

package.json declares metadata, module entry points, scripts, engines, and dependencies. Regular dependencies are required at runtime; dev dependencies support development/build workflows; peer dependencies express compatibility with a host package.

Reproducible commands

{
  "scripts": { "start": "node src/index.js", "lint": "eslint ." },
  "engines": { "node": ">=22" }
}

Scripts can read package metadata through ordinary JavaScript when runtime behavior depends on it:

import manifest from "./package.json" with { type: "json" };
console.log(`${manifest.name}@${manifest.version}`);

Use npm install to update dependency intent and lockfile; npm ci installs exactly from a compatible lockfile. Semantic versions communicate breaking, feature, and patch changes, while range symbols allow updates. Review install scripts and package provenance, audit vulnerabilities in context, remove unused packages, and never publish secrets.

Knowledge check

Answer every question correctly to complete this chapter.

Which statement best describes npm?

Which JavaScript term matches this description: The package manager and registry client commonly distributed with Node.

Which statement best describes package.json?

Which JavaScript term matches this description: A manifest describing package metadata, scripts, dependencies, and configuration.

Which statement best describes package-lock.json?

Which JavaScript term matches this description: A lockfile recording a reproducible resolved dependency graph.

Which statement best describes semantic version?

Which JavaScript term matches this description: A version scheme using major, minor, and patch components.

Which statement best describes npm script?

Which JavaScript term matches this description: A named project command run through npm run.

0 of 10 checks passed

Your progress is saved on this device.