npm

npm is the default Node.js package manager and a script runner for `package.json` workflows. Interview depth covers install modes, lockfile reproducibility, dependency scopes, lifecycle scripts, registry configuration, and CI discipline.

| Command | Typical use | |---------|-------------| | `npm install` | Local dev; may update `package-lock.json` | | `npm ci` | CI: install exactly from lockfile, fail on drift | | `npm run <script>` | Run lifecycle or custom scripts | | `npm audit` | Surface known vulnerability metadata |

					{
  "scripts": {
    "build": "tsc -p tsconfig.build.json",
    "test": "vitest run"
  },
  "dependencies": { "express": "^4.21.0" },
  "devDependencies": { "typescript": "^5.8.0" }
}
				

`dependencies` ship to production consumers; `devDependencies` stay in development and CI build/test paths. `package-lock.json` records the resolved graph including transitive versions and integrity hashes.

On interviews: contrast `npm install` versus `npm ci`, when lockfile diffs need review, how `preinstall`/`postinstall` scripts affect supply-chain risk, and registry or token configuration for private packages.

Common pitfalls: running `npm install` in CI and silently upgrading transitives; ignoring script hooks; mixing npm with Yarn/pnpm lockfiles in one repo.

The trade-off is npm ubiquity and zero-setup versus stricter alternatives that catch undeclared dependencies earlier.

Checklist:

• Use `npm ci` in CI for applications.
• Review lockfile diffs like application code.
• Separate runtime and dev dependency boundaries.
• Pin npm via `packageManager` or CI image when teams need consistency.