npm, package.json and node_modules

Model answer.

• npm is Node's package manager and the public registry of packages.
• package.json describes your project: name, version, scripts (npm run dev), and dependencies with version ranges ("express": "^4.19.0"). dependencies are needed at runtime; devDependencies only for development and building (test runners, linters).
• package-lock.json records the exact version of every installed package, including indirect ones, so every machine installs the same tree.
• node_modules is where the installed code lives.

Practice:

• Commit package.json and the lock file; do not commit node_modules. Add it to .gitignore, because it is large, platform-specific and fully reproducible.
• Use npm ci in CI and servers: it installs exactly what the lock file says.
• npx some-tool runs a package's command without installing it globally.
• Check for known vulnerabilities with npm audit, and keep dependencies few: each one is code you trust.