Modules and npm

Introduction

Real programs are made of many files. Modules let each file export what it offers and import what it needs. npm (Node Package Manager) lets you use code written by other people, called packages. Both are central to Node.

Two module systems

Node supports two styles, and you will meet both.

ES modules (ESM) are the modern, standard JavaScript way:

CommonJS (CJS) is the older Node style:

Both print 5. The file extension .mjs or .cjs tells Node which system a file uses. Plain .js files follow the "type" setting in package.json: "type": "module" means ESM, and the default is CommonJS. For new projects, choose ES modules.

Built-in modules

Node includes useful modules that you import by name, with the node: prefix to show they are built in:

package.json

Every project has a package.json, its identity card. Create one with:

npm init -y

It looks like this:

{
  "name": "demo",
  "version": "1.0.0",
  "type": "module",
  "scripts": {
    "start": "node app.js"
  }
}

• name and version identify the project.
• type sets the module system.
• scripts are shortcuts: npm start runs node app.js, and npm run name runs any other script.
• dependencies lists packages the project needs (added when you install).

Installing packages

npm install express

This downloads the package into a node_modules folder and records it in package.json. A package-lock.json file records the exact versions installed, so everyone gets the same ones. Commit package.json and the lock file to Git, but not node_modules.

Version numbers like ^5.1.0 follow semantic versioning: major, minor, patch. The caret allows minor and patch updates, but not a new major version, which may break things.

Using packages safely

Packages are code that runs on your machine, so treat them carefully.

• Prefer well-known, maintained packages with many users and recent updates.
• Check the name carefully, because attackers publish look-alike names.
• Keep dependencies few and up to date.
• Run npm audit to see known vulnerabilities.
• Do not run commands or install scripts from sources you do not trust.
• Remove packages you no longer use with npm uninstall.

Try it yourself

Create a folder, run npm init -y, set "type": "module", write lib.js that exports a function, import it in main.js and add a start script. Run it with npm start.

Summary

• Modules share code between files. Use ES modules (import and export) for new projects.
• package.json describes the project, the lock file pins versions, and node_modules is not committed.
• Install packages with npm carefully, and keep dependencies few, updated and audited.