The npm CLI and the registry

Knowing a dozen commands well saves hours of guessing about what is installed and why.

npm is two things: the registry at registry.npmjs.org, holding millions of packages, and the CLI that ships with Node.js. Node 24 bundles npm 11; npm 12 (July 2026) requires Node 22.22+/24.15+ and tightens several defaults, noted where relevant in these lessons.

Beyond install and run, the commands you will use every week:

npm view <pkg>: registry metadata: versions, dist-tags, dependencies, publish dates, repository. npm view react versions --json lists every version.
npm ls <pkg>: where a package sits in your installed tree; npm ls --all prints the whole tree.
npm explain <pkg> (alias why): the chain of dependents that caused it to be installed.
npm outdated: current, wanted and latest versions of your dependencies.
npm exec <bin> / npx <bin>: run a package's executable, from node_modules/.bin or a temporary download.
npm pkg get|set|delete: read and edit package.json fields from scripts without hand-editing JSON.
npm doctor, npm config list, npm help <command>.

Flags have long and short forms (--save-dev / -D, --global / -g). npm 12 is stricter: unknown flags and abbreviated flags are now errors rather than warnings, so spell flags out in scripts.

Global installs (-g) put binaries on your PATH but are invisible to the project; prefer devDependencies plus npx for project tools.

Example

npm --version                  # 11.x with Node 24
npm view express version       # latest published version, e.g. 5.1.0
npm view express dist-tags     # { latest: '5.1.0', next: '...', ... }
npm view express time.modified # last publish date

npm ls express                 # where it is installed in this project
npm explain debug              # why is "debug" in my tree?
# debug@4.4.0
# node_modules/debug
#   debug@"^4.4.0" from express@5.1.0
#   node_modules/express
#     express@"^5.1.0" from the root project

npm outdated                   # Current / Wanted / Latest per dependency
npm pkg get scripts.test       # read one field of package.json
npx eslint --version           # run a local or temporary binary

Remember

npm view reads registry metadata without installing
npm ls and npm explain answer what and why
npx/npm exec run package binaries
npm 12 rejects unknown or abbreviated flags

Watch out for

Installing project tools globally so builds depend on one machine's setup.

Check yourself

Which command shows the chain of packages that pulled a dependency into your tree?

Official docs: docs.npmjs.com/cli/v11/commands/npm-explain

Example

Remember

Watch out for

Check yourself

Builds on

Unlocks