A package manager for JavaScript and the Node.js ecosystem
—
Pending
Does it follow best practices?
Impact
Pending
No eval scenarios have been run
Pending
The risk profile of this skill
npm is the official package manager for JavaScript and the Node.js ecosystem. It provides command-line tools for installing, managing, and publishing packages to the npm registry, as well as managing project dependencies and scripts.
npm install -g npm to updatenpm is a command-line tool and does not provide a programmatic API. It must be used via command-line interface or child process execution:
const { spawn } = require('child_process');
// Execute npm commands programmatically
const npmInstall = spawn('npm', ['install', 'lodash'], { stdio: 'inherit' });For shell usage:
npm install <package>
npm publish
npm run <script># Initialize a new project
npm init
# Install dependencies
npm install express
npm install --save-dev jest
# Install global packages
npm install -g typescript
# Run project scripts
npm run build
npm test
# Publish a package
npm publishnpm CLI is built around several key command categories:
Core commands for installing and managing package dependencies in projects.
# Install packages from package.json
npm install
npm ci
# Add new dependencies
npm install <package>[@version]
npm install --save-dev <package>
npm install --global <package>
# Remove dependencies
npm uninstall <package>
npm uninstall --global <package>
# Update packages
npm update [package]
npm outdated
# Manage duplicate packages
npm dedupe
npm find-dupesCommands for interacting with the npm registry and publishing packages.
# Publish packages
npm publish [tarball|folder]
npm unpublish <package>[@version]
# Search and view packages
npm search <search-term>
npm view <package>[@version] [field]
# Manage package versions
npm version <newversion>
npm dist-tag add <package>@<version> [tag]
npm dist-tag rm <package> <tag>
npm dist-tag ls [package]
# Deprecate packages
npm deprecate <package>[@version] <message>
npm undeprecate <package>[@version]Commands for managing npm configuration, authentication, and user settings.
# Configuration management
npm config set <key> <value>
npm config get <key>
npm config delete <key>
npm config list
npm config edit
# User authentication
npm login
npm logout
npm whoami
# Registry and token management
npm adduser
npm token list
npm token create
npm token revoke <id>Execute package.json scripts and lifecycle hooks.
# Run package.json scripts
npm run <script-name>
npm run-script <script-name>
# Standard lifecycle scripts
npm start
npm test
npm stop
npm restart
# Script information
npm run
npm run-script --silent <script-name>Manage monorepo workspaces and workspace dependencies.
# Workspace operations
npm install --workspace=<workspace-name>
npm run <script> --workspace=<workspace-name>
npm run <script> --workspaces
# Workspace information
npm ls --workspaces
npm list --workspace=<workspace-name>Security vulnerability scanning and reporting.
# Security auditing
npm audit
npm audit fix
npm audit fix --force
# Package integrity
npm verify
npm doctor
# Generate reports
npm sbomnpm uses standard exit codes to indicate command success or failure:
0 - Success1 - General error2 - Misuse of shell command3 - Internal npm error4 - NPM configuration error5 - Network errornpm respects various environment variables for configuration:
# Common environment variables
NPM_CONFIG_REGISTRY=<registry-url>
NPM_CONFIG_CACHE=<cache-directory>
NPM_TOKEN=<authentication-token>
NODE_ENV=<environment>