What is the purpose of npm, package-lock.json, and the command npm ci?

🔍 What is npm?

npm stands for Node Package Manager. It is a tool that helps developers install, share, and manage packages (libraries) for Node.js projects.

npm is like an app store for Node.js code.
It allows you to add new features to your project without writing everything from scratch.
It also makes it easier to update and manage your dependencies.

Example:

// Installing a package
// Run this in the terminal
npm install express

This installs the Express library so you can build web applications faster.

📄 What is package-lock.json?

The package-lock.json file keeps an exact record of the versions of all installed packages and their dependencies.

It locks the package versions to avoid unexpected changes.
It ensures that every developer on your team uses the exact same versions.
It helps in creating consistent builds.

Example snippet from package-lock.json:

{
  "name": "my-app",
  "version": "1.0.0",
  "lockfileVersion": 2,
  "dependencies": {
    "express": {
      "version": "4.17.1",
      "resolved": "https://registry.npmjs.org/express/-/express-4.17.1.tgz"
    }
  }
}

This ensures express will always be installed as version 4.17.1.

⚡ What is npm ci?

The npm ci command is used to install dependencies in a clean, predictable way.

It deletes the existing node_modules folder before installing.
It installs exactly what is listed in package-lock.json.
It is faster than npm install for automated builds and CI/CD pipelines.

Example:

// Using npm ci in a terminal
npm ci

This ensures the dependencies match exactly what is in package-lock.json for stable builds.

📊 npm install vs npm ci

Feature	npm install	npm ci
Speed	Slower	Faster
Uses package-lock	Yes	Yes
Cleans node_modules	No	Yes
Predictable builds	Sometimes	Always

📝 Summary

In Node.js projects, npm is the package manager that installs and manages libraries, package-lock.json ensures exact version consistency, and npm ci installs packages in a clean, predictable way ideal for automated environments. Together, they make dependency management faster, more reliable, and easier to maintain.