npm
You might say
AI told me to install dependencies, and one command downloaded a ton of stuff. What's going on?
Install JavaScript packages and run project scriptsnpm is a package manager and command runner for JavaScript projects. package.json records dependencies and named scripts, while the lockfile keeps installed versions reproducible. Install packages intentionally and review scripts before running code from an unfamiliar project.
Know first
You can say this to an AI Agent
Confirm that the current directory contains package.json and its lockfile, then restore dependencies with the project's existing package manager. Do not copy or edit node_modules or add arbitrary global packages. Run the existing dev or check script afterward and report the result.
When to use it
- Install declared dependenciespackage.json
"dependencies": react, vite
"scripts": dev, buildManifest: which packages are installed and which commands can run - Add a library to a project$ npm install⸨░░░░░░⸩ idealTreeadded 42 packages in 6s
- Run scripts such as dev, test, and build$ npm run dev> vite✓ Ready in 1.2s
- Keep dependency versions reproducible with a lockfile☁️ Clone project→ install →📦 Rebuild from the repository
When NOT to use it
- Commit the node_modules directory📁 node_modules / react✎ Edit manuallyWhen dependencies are reinstalled, local changes like these are usually replaced.
- Delete the lockfile whenever versions conflictnode_modules 380MBgit push →A large number of reinstallable dependencies entered the repository; .gitignore should exclude them.
- Install a package before checking whether the platform already provides the feature📄 package.json🗑Dependency and script declarations are missing, so other environments cannot rebuild from the project configuration.
- Run an unfamiliar package script without reading itdependencies:
react, vue, jquery, lodash, moment, axios, fetch-huh…Adding dependencies before finding the cause broadens the conflict and maintenance surface.
Anatomy
{
"name": "my-first-page",
"dependencies": { "react": "^19.0.0" },
"scripts": { "dev": "vite", "build": "vite build" }
}
The name and version of the project, used when publishing and sharing
Which packages and versions are installed; install and move the goods accordingly.
npm run dev runs the command written here
Variants
install
npm install
Install new packages, or rebuild node_modules
run
npm run dev
Execute shortcut commands in scripts
uninstall
npm uninstall lodash
The bag is no longer needed, so cross it off the list.
lockfile
package-lock.json
Team unified version, don’t change it manually
Typical use cases
Project setup
Add dependency
$ npm install
⸨████████░░⸩ reify: react
added 42 packages in 6s
Dependencies will be installed to node_modules according to package.json and lock files
Development server
Production build
$ npm run dev
> my-first-page@0.1.0 dev
✓ Ready in 1.2s → http://localhost:3000
Shortcut commands in scripts, one for each string
Recommended tool
Web fine-tuning tool · Selector Pro
Select page elements for precise AI edits
Click a button, text, or card, note the change, then copy its exact location to AI.
Open Selector Pro website↗Further reading
Quick check