Written in JavaScript | License Artistic License 2.0 | |
 | ||
Developer(s) Isaac Z. Schlueter, Forrest Norvell, Robert Kowalski, Domenic Denicola, Tim Oxley, Evan Meagher, others Initial release January 12, 2010; 7 years ago (2010-01-12) Stable release 4.2.0 / 26 January 2017; 51 days ago (2017-01-26) Preview release 4.3.0 / 9 February 2017; 37 days ago (2017-02-09) | ||
npm is the default package manager for the JavaScript runtime environment Node.js.
Contents
History
npm is written entirely in JavaScript and was developed by Isaac Z. Schlueter as a result of having "seen module packaging done terribly" and with inspiration from the shortcomings of other similar projects such as PHP (PEAR) and Perl (CPAN).
Description
npm is automatically included when Node.js is installed. npm consists of a command line client that interacts with a remote registry. It allows users to consume and distribute JavaScript modules that are available on the registry. Packages on the registry are in CommonJS format and include a metadata file in JSON format. Over 280,000 packages are available on the main npm registry. The registry has no vetting process for submission, which means that packages found there can be low quality, insecure, or malicious. However, the npm server administrators are fully capable of deleting malicious packages or banning malicious users. npm exposes usage statistics and number of depending packages to assist developers in picking libraries.
Packages on npm are registered on a first-come, first-served basis and do not distinguish among authors, meaning that the unpublishing of a package can not only break the projects that depend on it, but also pose a security risk. For example, a package named "left-pad" that only padded the left side of strings inadvertently caused many builds to fail when it was removed.
Usage
npm can manage packages that are local dependencies of a particular project, as well as globally-installed JavaScript tools. When used as a dependency manager for a local project, npm can install, in one command, all the dependencies of a project through the package.json file. In the package.json file, each dependency can specify a range of valid versions using the semantic versioning scheme, allowing developers to auto-update their packages while at the same time avoiding unwanted breaking changes. npm also provides version-bumping tools for developers to tag their packages with a particular version.
Alternatives
There are a number of open-source alternatives to npm for installing modular JavaScript, including ied, pnpm, npm-install, npmd, and Yarn, the last of which was released by Facebook in October 2016. They are all compatible with the public npm registry and use it by default, but provide different client-side experiences, usually focused on improving performance and determinism versus the npm client.