npm Commands: A Package Management Guide

01What Is npm and What Is It Used For?

npm (Node Package Manager) is the package manager of the JavaScript world. It lets you add libraries written by others to your project, track their versions and run project-related commands from one place.

npm comes with Node.js; you do not need to install it separately. If you have not installed Node.js yet, first follow our Node.js installation guide, then try the commands in this article in your own terminal.

npm has three parts: the command-line tool on your computer, the registry where packages are hosted, and the package.json file at the heart of every project. Almost every command reads or updates this file.

02What Is package.json?

package.json is the project's ID card: its name, version, dependencies and runnable scripts are written here. In a new project you create this file with npm init; the -y flag skips all the questions with default answers.

• dependencies: Packages the application needs while running.
• devDependencies: Tools needed only during development and build (compiler, test tool, formatter).
• scripts: Short commands run with npm run.
• package-lock.json: Records the exact version of every installed package; be sure to add this file to Git.

mkdir ilk-proje
cd ilk-proje
npm init -y

{
  "name": "ilk-proje",
  "version": "1.0.0",
  "scripts": {
    "dev": "vite",
    "build": "vite build",
    "test": "node --test"
  },
  "dependencies": {
    "axios": "^1.7.0"
  },
  "devDependencies": {
    "vite": "^6.0.0"
  }
}

03Installing Packages with npm install

npm install is the most used command and does two different jobs. On its own, it installs all dependencies in package.json into the node_modules folder; with a package name, it installs that package and adds it to package.json. Its short form is npm i.

# Install all dependencies in the project
npm install

# Yeni paket ekle (dependencies)
npm install axios

# Add a development tool (devDependencies)
npm install -D prettier

# Install a specific version
npm install lodash@4

# Global install (for command line tools)
npm install -g serve

# Remove the package
npm uninstall axios

Global or local?

Install packages locally whenever possible, so the project runs with the same versions on another computer. Reserve global installs for command-line tools you will use everywhere; for one-off tools, npx is enough.

When should you use npm ci?

npm ci deletes the node_modules folder, installs the exact versions in package-lock.json and does not change the lock file. It is ideal for deploying to a server, for continuous integration pipelines and for solving "it worked on my machine" problems.

04Running Scripts with npm run

The scripts field in package.json lets you give short names to long commands. That way everyone on the team starts the development server with npm run dev and the production build with npm run build without knowing the details of the tool.

Some names, such as start and test, are special and run without typing run. Two dashes are used to pass extra parameters to a script.

npm run dev
npm run build
npm start
npm test

# List all defined scripts
npm run

# Pass a parameter to the script
npm run build -- --mode staging

pre and post scripts

If you add pre or post to the front of a script's name, npm runs it automatically before or after. For example, a script named prebuild can clean the old build folder right before npm run build. This pattern keeps anyone on the team from forgetting a step.

Why scripts find local tools

While running, npm run temporarily adds the project's node_modules/.bin folder to PATH. So in a script you only need to write vite or prettier; you do not have to install the tool globally. If the same tool is not found when typed directly in the terminal, this is why, and the fix is to use npx.

Operating system differences in scripts

Commands like rm -rf do not work in Windows' default shell. If your team uses different operating systems, prefer cross-platform Node.js tools or short Node.js scripts in your scripts; that way the same package.json gives the same result on every machine.

05Updating and Auditing Packages

Packages are updated regularly; security holes are closed and new features arrive. Before updating, run the npm outdated command to see what is out of date.

The ^ sign in package.json allows minor and patch versions (1.7.0 → 1.9.2), and the ~ sign allows only patch versions (1.7.0 → 1.7.5). npm update updates within these limits; to jump a major version you need to reinstall the package with @latest, and this usually requires code changes.

# Eskiyen paketleri listele
npm outdated

# Update within the allowed range
npm update

# Move to the next major version (use with care)
npm install axios@latest

# Security audit
npm audit
npm audit fix

# View installed packages
npm ls --depth=0
npm ls -g --depth=0

# The latest published version of a package
npm view axios version

06What Is npx and When to Use It?

npx is a package runner that comes with npm. It lets you run a tool once without installing it globally; the tool is first searched for in the project's node_modules, and if it is not there, it is downloaded temporarily.

Creating a project template is the most common use of npx. For example, the npm create command is used to start a new React project with Vite; you can find the details in our React setup with Vite article.

# Serve the folder on a local server
npx serve .

# Run the formatter installed in the project
npx prettier --write .

# New project from a template (does the same job as npm create, npx create-...)
npm create vite@latest

07npm vs yarn vs pnpm

npm is not the only option; yarn and pnpm also install packages from the same registry. Since all three use package.json, the project structure does not change; the differences show up in install speed, disk usage and the lock file.

• Use a single package manager in a project; having two lock files at once leads to version confusion.
• If you are joining an existing project, look at the lock file in the folder and pick the same tool.
• If you are just starting, starting with npm is the path of least friction.

08Common Errors and Fixes

Most npm errors come from a corrupted cache, an incompatible Node.js version or conflicting dependencies. First read the first lines of the error message; the solution is usually explained there.

• ERESOLVE / peer dependency error: One of the packages expects a different version of another package. Update the packages to compatible versions; as a temporary workaround, npm install --legacy-peer-deps can be used.
• Corrupted node_modules: Delete the node_modules folder and run npm install or npm ci. Deleting the lock file is the last resort.
• Cache problem: npm cache verify checks the cache; if necessary, clear it with npm cache clean --force.
• EACCES permission error: Do not use sudo for global installs; reinstall Node.js with nvm.
• Engine warning: If a package wants a newer Node.js, switch to the LTS version with nvm.

09Using npm Well in Your Projects

Too many packages increase both the security risk and the amount of JavaScript a page sends to the browser. Asking "can I solve this with a few lines of code?" before each new dependency is the cheapest optimization for page speed. We cover this topic regularly in our speed and performance optimization service.

Never add the node_modules folder to Git; list it in .gitignore and share only package.json and the lock file. We explained pushing a project to a remote repository step by step in our uploading a project to GitHub guide.

If you are planning web design for your business, or an integration project that connects payment, shipping and accounting systems, setting up dependency management correctly from the start lowers maintenance costs in the long run. For more Node.js content, browse the nodejs tag page.