npm, package.json, and Dependencies

npm is a package manager commonly used with Node.js projects. A package.json file describes a project, including scripts and dependencies. A lockfile such as package-lock.json records a resolved dependency tree to make installations more reproducible.

A script section may look like this:

{
  "scripts": {
    "dev": "next dev",
    "lint": "eslint",
    "build": "next build"
  }
}

Run a script with npm run lint, for example. npm ci installs from the lockfile and is commonly used in clean CI environments; it expects the manifest and lockfile to agree. npm install can update the lockfile as dependency requirements change.

Dependencies#

Production dependencies are needed by the application at runtime. Development dependencies often include tools used to build, lint, test, or bundle it. Packages can have transitive dependencies, so only install packages you trust and keep them updated through a deliberate process.

Keep secrets out of source control#

Do not commit .env files with real secrets. Use environment variables and deployment secret management for credentials. A variable prefixed for public frontend exposure should never contain a private secret.

Practice#

Inspect a JavaScript project's package.json. Identify its main scripts, production dependencies, development dependencies, and lockfile. Do not edit dependencies until you understand why the change is needed.