NPM — Dependency Management in the JavaScript Ecosystem

Maven in the Java world has a central repository and strict versioning. NPM has 200,000 packages, the left-pad incident, and dependency hell. Here is how to survive in the NPM ecosystem without stepping on a landmine.

package.json and semver¶

Semantic versioning: MAJOR.MINOR.PATCH. ^1.2.3 = compatible with 1.x (the default). ~1.2.3 = patch updates only. For production we recommend exact versions or shrinkwrap/lockfile.

{
  "dependencies": {
    "express": "^4.13.3",
    "lodash": "~4.17.0",
    "moment": "2.11.2"
  },
  "devDependencies": {
    "mocha": "^2.3.4",
    "eslint": "^1.10.0"
  }
}

npm shrinkwrap¶

npm shrinkwrap locks the exact versions of all dependencies (including transitive ones). It generates npm-shrinkwrap.json — commit it to git. Without shrinkwrap, npm install may install different versions on CI than locally.

Security¶

npm audit checks for known vulnerabilities. Run it regularly in your CI pipeline. Minimize dependencies — every package is a potential attack vector. Ask yourself: do I really need a library for left-pad?

Private Registry¶

For internal packages: Verdaccio (open-source npm proxy/registry), npm Enterprise, or Artifactory. These cache public packages and host private ones.

Discipline in Dependency Management¶

The NPM ecosystem is powerful but wild. Lockfiles, audits, and minimal dependencies are the foundations of a reliable JavaScript project.