npm

Anyone writing a website or a program constantly needs things that others have already built: a calendar display, a spell checker, a function for converting dates. npm is a huge public collection of such ready-made building blocks. Each building block is called a package there and consists of program code that you’re allowed to build into your own project for free. npm consists of two things: the collection itself, which sits on the internet, and a small tool on your own computer that downloads packages and files them away. The name originally stood for “Node Package Manager”, because the whole thing was built for the Node.js programming environment. Today it’s the standard way that almost all web developers get hold of other people’s code.

Why hardly any web project gets by without npm

npm is the largest code collection in the world. Well over two million packages are stored there, and they are downloaded billions of times per week. Practically every larger website you visit contains code that came from there at some point. This saves an enormous amount of work: instead of spending three days on a date function, you type a single command.

This convenience has a downside that regularly makes the news. A package itself often uses other packages, and those in turn use further ones. So a single installation can quickly pull in hundreds of foreign building blocks. Experts call this a dependency chain. If a single link in this chain is manipulated, malicious code automatically spreads to everyone who uses it.

Exactly this has happened several times. Attackers have stolen the login credentials of package authors and secretly published malicious versions. On another occasion, a developer deleted a tiny eleven-line package out of protest — and thousands of projects worldwide could no longer be built. Such incidents are called supply chain attacks, because they don’t hit the target itself, but rather its supplier.

From a single command to a folder full of foreign code

The process is simple. You type a command like “npm install react” into a text window. The tool asks the npm server for the package, downloads it, and places it in a folder called node_modules. All packages that this package itself needs come along automatically.

To keep this traceable, every project keeps a kind of shopping list. It’s stored in the file package.json and lists all directly desired packages along with version numbers. A second file, the lockfile, additionally records which exact version was actually installed. This way, a colleague who loads the project gets exactly the same building blocks, and not accidentally newer ones.

Version numbers follow a fixed logic, usually three numbers like 4.17.2. The first only changes when something is no longer backward-compatible. The last indicates minor bug fixes. Anyone who only updates the last number therefore risks little — a jump in the first number can bring a project to a halt.

npm in developers' everyday life and in tech news

If you read a tutorial for a programming project anywhere, it almost certainly contains a line with “npm install”. Starting a project also often runs through npm, for instance with “npm run dev”. For beginners, this is often their very first contact with a command line at all.

In business news, npm usually comes up in two contexts. First, in security incidents, when a popular package has been hijacked and companies have to check whether their software is affected. Second, in regulation: new rules increasingly require companies to keep a bill of materials for their software, so that in an emergency they know which foreign building blocks they’ve built in.

An important distinction: npm belongs to the world of JavaScript. Other programming languages have their own collections, such as PyPI for Python. A common misconception is also that npm is a company that checks the code. This is not the case — anyone is allowed to publish there, and responsibility for quality lies with whoever builds a package in.