What Is npm (Node Package Manager)?
npm (Node Package Manager) is the default package manager for Node.js: a command-line tool and a public online registry used to install, share and manage JavaScript packages such as Bootstrap, Sass and build tools. It records a project's dependencies in a package.json file so anyone can recreate the same setup with a single npm install command.
What Is npm (Node Package Manager)?
npm has three parts: the website at npmjs.com, where you search for packages and read their documentation; the registry, a very large public database of open-source JavaScript packages; and the command-line interface (CLI) that you run in a terminal. The CLI is installed automatically with Node.js, so running node -v and npm -v confirms both are available. Front-end developers use npm even when their website has no Node.js server, because the tools that compile Sass, bundle JavaScript, optimise images and run local development servers are distributed as npm packages. Bootstrap itself is published on npm as bootstrap, which gives you its Sass source files for customisation. npm, Inc. was acquired by GitHub in 2020, and the same registry is used by alternative clients such as Yarn and pnpm, which read the same package.json format.
How npm (Node Package Manager) Works
A project starts with npm init, which creates package.json: a JSON file holding the project's name, version, scripts and dependency lists. Running npm install bootstrap downloads the package and everything it depends on into a node_modules folder and adds it to dependencies, while npm install --save-dev sass adds a tool you only need during development to devDependencies. Version ranges follow semantic versioning (major.minor.patch): "bootstrap": "^5.3.3" allows any later 5.x release, while ~5.3.3 allows only patch releases such as 5.3.4. Because ranges can resolve to different versions over time, npm also writes package-lock.json, which records the exact version of every installed package so that npm ci can reproduce an identical node_modules folder on another machine or build server. The scripts section defines named commands, so "build": "sass scss/main.scss css/main.css" can be run with npm run build, and npm makes the project's locally installed tools available while it runs. The npx command runs a package's executable without a global install, for example npx sass --version. Other everyday commands include npm outdated to list available updates, npm update to apply updates within your allowed ranges, and npm audit to report known security vulnerabilities in the dependency tree.
Best Practices for npm (Node Package Manager)
Commit package.json and package-lock.json to version control, but never node_modules, which should be listed in .gitignore and can always be rebuilt. Use npm ci rather than npm install in continuous integration and deployment, because it installs exactly what the lockfile specifies and fails if the lockfile and package.json disagree. Keep build tools in devDependencies so production installs can skip them with npm ci --omit=dev. Record the Node.js version the project expects, in an engines field or an .nvmrc file, so collaborators and servers use a compatible version. Treat every new dependency as code you are responsible for: check its maintenance activity, adoption and licence, and watch for typosquatted names that imitate popular packages, a technique attackers have used to publish malicious code. Run npm audit regularly and update dependencies in small, tested steps rather than jumping several major versions at once. For Bootstrap, install the exact version you need (npm install bootstrap@5.3.3), and if you import the individual JavaScript plugins that rely on Popper, such as dropdowns, tooltips and popovers, install @popperjs/core as well, or use bootstrap.bundle.min.js, which includes it. If you publish packages yourself, enable two-factor authentication on your npm account.
npm (Node Package Manager) and Canvas Builder
Canvas Builder exports sites as ready-to-host HTML, CSS, JavaScript, fonts and images, so you do not need npm or a build step to deploy the downloaded ZIP. npm becomes relevant if a developer wants to bring the exported code into an existing build pipeline, for example to recompile Bootstrap's Sass with the brand's own variables or to bundle scripts alongside other packages.
Start building freeFrequently asked questions
What is the difference between npm and npx?
npm installs and manages packages and runs the scripts defined in package.json. npx, which comes with npm, runs a package's command directly, using the project's local copy if one exists or downloading it temporarily if not. It is useful for one-off commands and for tools you do not want to install globally.
What is package-lock.json and should I commit it?
package-lock.json records the exact version of every package npm installed, including the dependencies of dependencies. Yes, commit it: it ensures that teammates and build servers running npm ci get the same versions you tested, which prevents "works on my machine" problems.
Do I need npm to use Bootstrap?
No. You can link Bootstrap's compiled CSS and JavaScript files directly, either from a CDN or from files saved in your project. npm becomes useful when you want to customise Bootstrap's Sass variables, include only the parts you use, or manage updates alongside other build tools.
What is the difference between npm, Yarn and pnpm?
All three install packages from the npm registry using package.json. Yarn and pnpm are alternative clients created to improve on npm's speed and disk usage; pnpm, for example, stores each package version once on disk and links it into projects. For most projects, the choice matters less than using one tool consistently with its lockfile.