Topolearn

Learn npm

The package manager and registry client that ships with Node.js

15 lessons · 3 hours · 4 levels · covers npm 11 (bundled with Node 24) and 12

npm is the package manager bundled with Node.js and the client for the npm registry, the largest package registry in the world. It installs and locks dependency trees, runs project scripts, manages monorepo workspaces and publishes packages, so mastering it means reproducible builds, safer dependencies and smooth releases.

Sign in free to track progressOfficial docs ↗

Before you start

npm builds on these; the tree links to the exact lessons you need.

Node.jsEssentials level

How deep do you want to go?

1. EssentialsRead and write simple code, do the everyday basics5 lessons · 58 min in total
2. PracticalUse it productively at work, with the usual idioms9 lessons · 2 hours in total
3. AdvancedThe less common features, performance and trade-offs12 lessons · 3 hours in total
4. ExpertInternals and the edge cases experts know15 lessons · 3 hours in total

The npm tree

npmThe npm CLI and the registryThe npm CLI and theregistryVersion ranges and dist-tagsVersion ranges anddist-tagspackage-lock.json and npm cipackage-lock.jsonand npm cinpm scripts and lifecycle hooksnpm scripts andlifecycle hooksDependency types: dev, peer, optionalDependency types:dev, peer, optionalUpdating dependencies safelyUpdatingdependencies safely.npmrc, scopes and private registries.npmrc, scopes andprivate registriesPublishing a packagePublishing a packageWorkspaces and monoreposWorkspaces andmonoreposnpm and package.jsonnpm andpackage.jsonVersions, lockfiles and npm ciVersions, lockfilesand npm ciEnvironment variables and .env filesEnvironmentvariables and .env f…Modules: ES modules vs CommonJSModules: ES modulesvs CommonJS
Essentials and Practical shown (9 of 15 lessons); the full list is below. Click a lesson to read it.

All 15 lessons, in order

Everyday npm

  1. The npm CLI and the registry · Essentials · 10 min

    Find your way around the npm CLI: inspect packages with view, see what is installed with ls, and get help for any command.

  2. npm scripts and lifecycle hooks · Essentials · 12 min

    Write package.json scripts, pass arguments with --, use pre/post hooks and npm_ environment variables, and run binaries with npm exec.

Managing dependencies

  1. Version ranges and dist-tags · Essentials · 12 min

    Read every semver range form npm accepts, install from dist-tags like next, and decide when to pin exact versions.

  2. package-lock.json and npm ci · Essentials · 12 min

    Understand what the lockfile records, when npm install changes it, how npm ci uses it, and how to resolve lockfile merge conflicts.

  3. Dependency types: dev, peer, optional · Essentials · 12 min

    Choose between dependencies, devDependencies, peerDependencies and optionalDependencies, and install subsets with --omit.

  4. Updating dependencies safely · Practical · 12 min

    Keep dependencies current with outdated, update and targeted major upgrades, deduplicate the tree, and automate with bots.

Configuration and monorepos

  1. .npmrc, scopes and private registries · Practical · 12 min

    Configure npm per project, user and machine with .npmrc, route scopes to private registries, and pass auth tokens safely.

  2. Workspaces and monorepos · Practical · 15 min

    Manage several packages in one repository with npm workspaces: one install, one lockfile, linked local packages and per-workspace commands.

Publishing packages

  1. Publishing a package · Practical · 15 min

    Prepare a package with files and metadata, preview it with npm pack, bump versions with npm version, and publish with dist-tags.

  2. Package entry points: exports and types · Advanced · 15 min

    Define a package's public API with the exports field, conditional exports for ESM, CommonJS and types, and subpath imports.

  3. Trusted publishing and provenance · Advanced · 12 min

    Publish from CI with OIDC trusted publishing instead of long-lived tokens, and attach provenance so users can verify where a package was built.

Supply-chain security

  1. Auditing and overriding dependencies · Advanced · 12 min

    Read npm audit reports, fix vulnerabilities with audit fix or targeted upgrades, and force transitive versions with overrides.

  2. Defending against supply-chain attacks · Expert · 15 min

    Control install scripts with allowScripts, restrict git and URL dependencies, delay fresh releases, and harden CI installs.

How installs work

  1. How npm builds node_modules · Expert · 15 min

    Understand npm's ideal tree, hoisting and duplication, phantom dependencies, install strategies, and how pnpm differs.

  2. Inside package-lock.json · Expert · 12 min

    Read lockfileVersion 3: the packages map keyed by install path, resolved URLs, integrity hashes, flags, and the hidden lockfile.