npm

You might say

AI told me to install dependencies, and one command downloaded a ton of stuff. What's going on?

Install JavaScript packages and run project scriptsnpm is a package manager and command runner for JavaScript projects. package.json records dependencies and named scripts, while the lockfile keeps installed versions reproducible. Install packages intentionally and review scripts before running code from an unfamiliar project.

Know first

Terminal

package.json · Manifest "react": "^19.0.0" "vite": "^6.0.0" "scripts": dev / build

npm
install
→

node_modules · Dependency directory 📦 react 📦 vite 📦…42 packages in total

Quick checkChoose the best answer

You just cloned a JavaScript project. It contains package.json and a lockfile but no node_modules. How should dependencies be restored?

Ask a teammate to zip their node_modules and copy it over the projectEnter the project directory, run npm install, then use the project's defined scriptsInstall every missing package globally until the startup errors disappear

You can say this to an AI Agent

Confirm that the current directory contains package.json and its lockfile, then restore dependencies with the project's existing package manager. Do not copy or edit node_modules or add arbitrary global packages. Run the existing dev or check script afterward and report the result.

When to use it

Install declared dependencies
package.json
"dependencies": react, vite
"scripts": dev, buildManifest: which packages are installed and which commands can run
Add a library to a project
$ npm install⸨░░░░░░⸩ idealTreeadded 42 packages in 6s
Run scripts such as dev, test, and build
$ npm run dev> vite✓ Ready in 1.2s
Keep dependency versions reproducible with a lockfile
☁️ Clone project→ install →📦 Rebuild from the repository

When NOT to use it

Commit the node_modules directory
📁 node_modules / react✎ Edit manually
When dependencies are reinstalled, local changes like these are usually replaced.
Delete the lockfile whenever versions conflict
node_modules 380MBgit push →
A large number of reinstallable dependencies entered the repository; .gitignore should exclude them.
Install a package before checking whether the platform already provides the feature
📄 package.json🗑
Dependency and script declarations are missing, so other environments cannot rebuild from the project configuration.
Run an unfamiliar package script without reading it
dependencies:
react, vue, jquery, lodash, moment, axios, fetch-huh…Adding dependencies before finding the cause broadens the conflict and maintenance surface.

Anatomy

{ "name": "my-first-page", "dependencies": { "react": "^19.0.0" }, "scripts": { "dev": "vite", "build": "vite build" } }

The name and version of the project, used when publishing and sharing

Which packages and versions are installed; install and move the goods accordingly.

npm run dev runs the command written here

Variants

install

npm install

Install new packages, or rebuild node_modules

run

npm run dev

Execute shortcut commands in scripts

uninstall

npm uninstall lodash

The bag is no longer needed, so cross it off the list.

lockfile

package-lock.json

Team unified version, don’t change it manually

Typical use cases

Project setup

package.json

        {

          "name": "my-first-page",

          "dependencies": { "react": "^19.0.0" },

          "scripts": { "dev": "vite", "build": "vite build" }

        }

Add dependency

zsh — my-first-page

$ npm install ⸨████████░░⸩ reify: react added 42 packages in 6s Dependencies will be installed to node_modules according to package.json and lock files

Development server

my-first-page

📁 node_modules380 MB · ⚠ Automatically generated, do not move

📄 package.jsonEvents

📄 .gitignoreIt says node_modules and .env

Production build

zsh — my-first-page

$ npm run dev > my-first-page@0.1.0 dev ✓ Ready in 1.2s → http://localhost:3000 Shortcut commands in scripts, one for each string

Want GPT or Codex?VibeHubGPT support

GPT-6 Astra

Build in 3D. Put your computer to work.