<h1id="how-to-use-nodejs-modules-with-npm-and-packagejson">How To Use Node.js Modules with npm and package.json</h1>
<p><em>The author selected the <ahref="https://www.brightfunds.org/funds/open-internet-free-speech">Open Internet/Free Speech Fund</a> to receive a donation as part of the <ahref="https://do.co/w4do-cta">Write for DOnations</a> program.</em></p>
<h3id="introduction">Introduction</h3>
<p>Because of such features as its speedy Input/Output (I/O) performance and its basis in the well-known JavaScript language, <ahref="https://nodejs.org/en/">Node.js</a> has quickly become a popular runtime environment for back-end web development. But as interest grows, larger applications are built, and managing the complexity of the codebase and its dependencies becomes more difficult. Node.js organizes this complexity using <em>modules</em>, which are any single JavaScript files containing functions or objects that can be used by other programs or modules. A collection of one or more modules is commonly referred to as a <em>package</em>, and these packages are themselves organized by package managers. </p>
<p>The <ahref="https://www.npmjs.com/">Node.js Package Manager (npm)</a> is the default and most popular package manager in the Node.js ecosystem, and is primarily used to install and manage external modules in a Node.js project. It is also commonly used to install a wide range of CLI tools and run project scripts. npm tracks the modules installed in a project with the <code>package.json</code> file, which resides in a project’s directory and contains:</p>
<ul>
<li>All the modules needed for a project and their installed versions</li>
<li>All the metadata for a project, such as the author, the license, etc.</li>
<li>Scripts that can be run to automate tasks within the project</li>
</ul>
<p>As you create more complex Node.js projects, managing your metadata and dependencies with the <code>package.json</code> file will provide you with more predictable builds, since all external dependencies are kept the same. The file will keep track of this information automatically; while you may change the file directly to update your project’s metadata, you will seldom need to interact with it directly to manage modules.</p>
<p>In this tutorial, you will manage packages with npm. The first step will be to create and understand the <code>package.json</code> file. You will then use it to keep track of all the modules you install in your project. Finally, you will list your package dependencies, update your packages, uninstall your packages, and perform an audit to find security flaws in your packages.</p>
<h2id="prerequisites">Prerequisites</h2>
<p>To complete this tutorial, you will need:</p>
<ul>
<li>Node.js installed on your development machine. This tutorial uses version 18.3.0. To install this on macOS, follow the steps in <ahref="https://www.digitalocean.com/community/tutorials/how-to-install-node-js-and-create-a-local-development-environment-on-macos">How to Install Node.js and Create a Local Development Environment on macOS</a>; to install this on Ubuntu 20.04, follow the <strong>Installing Using a PPA</strong> or <strong>Installing using the Node Version Manager</strong> section of <ahref="https://www.digitalocean.com/community/tutorials/how-to-install-node-js-on-ubuntu-20-04">How To Install Node.js on Ubuntu 20.04</a>. By having Node.js installed you will also have npm installed; this tutorial uses version 8.11.0.</li>
</ul>
<h2id="step-1-creating-a-packagejson-file">Step 1 — Creating a <code>package.json</code> File</h2>
<p>We begin this tutorial by setting up the example project—a fictional Node.js <code>locator</code> module that gets the user’s IP address and returns the country of origin. You will not be coding the module in this tutorial. However, the packages you manage would be relevant if you were developing it. </p>
<p>First, you will create a <code>package.json</code> file to store useful metadata about the project and help you manage the project’s dependent Node.js modules. As the suffix suggests, this is a JSON (JavaScript Object Notation) file. JSON is a standard format used for sharing, based on <ahref="https://www.digitalocean.com/community/tutorials/understanding-objects-in-javascript">JavaScript objects</a> and consisting of data stored as key-value pairs. If you would like to learn more about JSON, read our <ahref="https://www.digitalocean.com/community/tutorials/an-introduction-to-json">Introduction to JSON</a> article.</p>
<p>Since a <code>package.json</code> file contains numerous properties, it can be cumbersome to create manually, without copy and pasting a template from somewhere else. To make things easier, npm provides the <code>init</code> command. This is an interactive command that asks you a series of questions and creates a <code>package.json</code> file based on your answers.</p>
<h3id="using-the-init-command">Using the <code>init</code> Command</h3>
<p>First, set up a project so you can practice managing modules. In your shell, create a new folder called <code>locator</code>:</p>
<strong>Note</strong>: If your code will use Git for version control, create the Git repository first and then run <code>npm init</code>. The command automatically understands that it is in a Git-enabled folder. If a Git remote is set, it automatically fills out the <code>repository</code>, <code>bugs</code>, and <code>homepage</code> fields for your <code>package.json</code> file. If you initialized the repo after creating the <code>package.json</code> file, you will have to add this information in yourself. For more on Git version control, see our <ahref="https://www.digitalocean.com/community/tutorial_series/introduction-to-git-installation-usage-and-branches">Introduction to Git: Installation, Usage, and Branches</a> series.
<p>You will first be prompted for the <code>name</code> of your new project. By default, the command assumes it’s the name of the folder you’re in. Default values for each property are shown in parentheses <code>()</code>. Since the default value for <code>name</code> will work for this tutorial, press <code>ENTER</code> to accept it.</p>
<p>The next value to enter is <code>version</code>. Along with the <code>name</code>, this field is required if your project will be shared with others in the npm package repository. </p>
<p><$>[note]
<strong>Note:</strong> Node.js packages are expected to follow the <ahref="https://semver.org/">Semantic Versioning</a> (semver) guide. Therefore, the first number will be the <code>MAJOR</code> version number that only changes when the API changes. The second number will be the <code>MINOR</code> version that changes when features are added. The last number will be the <code>PATCH</code> version that changes when bugs are fixed.
<p>The next field is <code>description</code>—a useful string to explain what your Node.js module does. Our fictional <code>locator</code> project would get the user’s IP address and return the country of origin. A fitting <code>description</code> would be <code>Finds the country of origin of the incoming request</code>, so type in something like this and press <code>ENTER</code>. The <code>description</code> is very useful when people are searching for your module.</p>
<p>The following prompt will ask you for the <code>entry point</code>. If someone installs and <code>requires</code> your module, what you set in the <code>entry point</code> will be the first part of your program that is loaded. The value needs to be the relative location of a JavaScript file, and will be added to the <code>main</code> property of the <code>package.json</code>. Press <code>ENTER</code> to keep the default value of <code>index.js</code>.</p>
<strong>Note</strong>: Most modules have an <code>index.js</code> file as the main point of entry. This is the default value for a <code>package.json</code>‘s <code>main</code> property, which is the point of entry for npm modules. If there is no <code>package.json</code>, Node.js will try to load <code>index.js</code> by default.
<$></p>
<p>Next, you’ll be asked for a <code>test command</code>, an executable script or command to run your project tests. In many popular Node.js modules, tests are written and executed with <ahref="https://mochajs.org/">Mocha</a>, <ahref="https://jestjs.io/">Jest</a>, <ahref="https://jasmine.github.io/">Jasmine</a>, or other test frameworks. Since testing is beyond the scope of this article, leave this option empty for now, and press <code>ENTER</code> to move on.</p>
<p>The <code>init</code> command will then ask for the project’s git repository, which may live on a service such as GitHub (for more information, see <ahref="https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-repositories">GitHub’s Repository documentation</a>). You won’t use this in this example, so leave it empty as well.</p>
<p>After the repository prompt, the command asks for <code>keywords</code>. This property is an array of strings with useful terms that people can use to find your repository. It’s best to have a small set of words that are really relevant to your project, so that searching can be more targeted. List these keywords as a string with commas separating each value. For this sample project, type <code>ip,geo,country</code> at the prompt. The finished <code>package.json</code> will have three items in the array for <code>keywords</code>.</p>
<p>The next field in the prompt is <code>author</code>. This is useful for users of your module who want to get in contact with you. For example, if someone discovers an exploit in your module, they can use this to report the problem so that you can fix it. The <code>author</code> field is a string in the following format: <code>"<^>Name<^> \<<^>Email<^>\> (<^>Website<^>)"</code>. For example, <code>"Sammy \<sammy@your_domain\> (https://your_domain)"</code> is a valid author. The email and website data are optional—a valid author could just be a name. Add your contact details as an author and confirm with <code>ENTER</code>.</p>
<p>Finally, you’ll be prompted for the <code>license</code>. This determines the legal permissions and limitations users will have while using your module. Many Node.js modules are open source, so npm sets the default to <ahref="https://www.npmjs.com/package/isc-license">ISC</a>.</p>
<p>At this point, you would review your licensing options and decide what’s best for your project. For more information on different types of open source licenses, see this <ahref="https://opensource.org/licenses">license list from the Open Source Initiative</a>. If you do not want to provide a license for a private repository, you can type <code>UNLICENSED</code> at the prompt. For this sample, use the default ISC license, and press <code>ENTER</code> to finish this process.</p>
<p>The <code>init</code> command will now display the <code>package.json</code> file it’s going to create. It will look similar to this:</p>
<spanclass="w"></span><spanclass="na">"description": "Finds the country of origin of the incoming request",</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="na">"test": "echo \"Error: no test specified\"&& exit 1"</span><spanclass="w"></span>
<spanclass="na">Is this OK? (yes)</span><spanclass="w"></span>
</code></pre></div>
<p>Once the information matches what you see here, press <code>ENTER</code> to complete this process and create the <code>package.json</code> file. With this file, you can keep a record of modules you install for your project.</p>
<p>Now that you have your <code>package.json</code> file, you can test out installing modules in the next step.</p>
<p>It is common in software development to use external libraries to perform ancillary tasks in projects. This allows the developer to focus on the business logic and create the application more quickly and efficiently by utilizing tools and code that others have written that accomplish tasks one needs.</p>
<p>For example, if our sample <code>locator</code> module has to make an external API request to get geographical data, we could use an HTTP library to make that task easier. Since our main goal is to return pertinent geographical data to the user, we could install a package that makes HTTP requests easier for us instead of rewriting this code for ourselves, a task that is beyond the scope of our project.</p>
<p>Let’s run through this example. In your <code>locator</code> application, you will use the <ahref="https://github.com/axios/axios">axios</a> library, which will help you make HTTP requests. Install it by entering the following in your shell:</p>
<p>You begin this command with <code>npm install</code>, which will install the package (for brevity you can also use <code>npm i</code>). You then list the packages that you want installed, separated by a space. In this case, this is <code>axios</code>. Finally, you end the command with the optional <code>--save</code> parameter, which specifies that <code>axios</code> will be saved as a project dependency.</p>
<spanclass="w"></span><spanclass="nt">"description"</span><spanclass="p">:</span><spanclass="w"></span><spanclass="s2">"Finds the country of origin of the incoming request"</span><spanclass="p">,</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="nt">"test"</span><spanclass="p">:</span><spanclass="w"></span><spanclass="s2">"echo \"Error: no test specified\"&& exit 1"</span><spanclass="w"></span>
<p>The <code>--save</code> option told <code>npm</code> to update the <code>package.json</code> with the module and version that was just installed. This is great, as other developers working on your projects can easily see what external dependencies are needed.</p>
<strong>Note</strong>: You may have noticed the <code>^</code> before the version number for the <code>axios</code> dependency. Recall that semantic versioning consists of three digits: <strong>MAJOR</strong>, <strong>MINOR</strong>, and <strong>PATCH</strong>. The <code>^</code> symbol signifies that any higher MINOR or PATCH version would satisfy this version constraint. If you see <code>~</code> at the beginning of a version number, then only higher PATCH versions satisfy the constraint.
<p>When you are finished reviewing <code>package.json</code>, close the file. If you used nano to edit the file, you can do so by pressing <code>CTRL + X</code> and then <code>ENTER</code>.</p>
<p>Packages that are used for the development of a project but not for building or running it in production are called <em>development dependencies</em>. They are not necessary for your module or application to work in production, but may be helpful while writing the code.</p>
<p>For example, it’s common for developers to use <ahref="https://en.wikipedia.org/wiki/Lint_(software)"><em>code linters</em></a> to ensure their code follows best practices and to keep the style consistent. While this is useful for development, this only adds to the size of the distributable without providing a tangible benefit when deployed in production.</p>
<p>Install a linter as a development dependency for your project. Try this out in your shell:</p>
<p>In this command, you used the <code>--save-dev</code> flag. This will save <code>eslint</code> as a dependency that is only needed for development. Notice also that you added <code>@8.0.0</code> to your dependency name. When modules are updated, they are tagged with a version. The <code>@</code> tells npm to look for a specific tag of the module you are installing. Without a specified tag, npm installs the latest tagged version. Open <code>package.json</code> again:</p>
<spanclass="w"></span><spanclass="nt">"description"</span><spanclass="p">:</span><spanclass="w"></span><spanclass="s2">"Finds the country of origin of the incoming request"</span><spanclass="p">,</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="nt">"test"</span><spanclass="p">:</span><spanclass="w"></span><spanclass="s2">"echo \"Error: no test specified\"&& exit 1"</span><spanclass="w"></span>
<p><code>eslint</code> has been saved as a <code>devDependencies</code>, along with the version number you specified earlier. Exit <code>package.json</code>.</p>
<h3id="automatically-generated-files-node_modules-and-package-lockjson">Automatically Generated Files: <code>node_modules</code> and <code>package-lock.json</code></h3>
<p>When you first install a package to a Node.js project, <code>npm</code> automatically creates the <code>node_modules</code> folder to store the modules needed for your project and the <code>package-lock.json</code> file that you examined earlier. </p>
<p>Confirm these are in your working directory. In your shell, type <code>ls</code> and press <code>ENTER</code>. You will observe the following output:</p>
<p>The <code>node_modules</code> folder contains every installed dependency for your project. In most cases, you should <strong>not</strong> commit this folder into your version controlled repository. As you install more dependencies, the size of this folder will quickly grow. Furthermore, the <code>package-lock.json</code> file keeps a record of the exact versions installed in a more succinct way, so including <code>node_modules</code> is not necessary.</p>
<p>While the <code>package.json</code> file lists dependencies that tell us the suitable versions that should be installed for the project, the <code>package-lock.json</code> file keeps track of all changes in <code>package.json</code> or <code>node_modules</code> and tells us the exact version of the package installed. You usually commit this to your version controlled repository instead of <code>node_modules</code>, as it’s a cleaner representation of all your dependencies.</p>
<h3id="installing-from-packagejson">Installing from package.json</h3>
<p>With your <code>package.json</code> and <code>package-lock.json</code> files, you can quickly set up the same project dependencies before you start development on a new project. To demonstrate this, move up a level in your directory tree and create a new folder named <code>cloned_locator</code> in the same directory level as <code>locator</code>:</p>
<p>To install the required modules for this project, type:</p>
<divclass="codehilite"><pre><span></span><code>npm i
</code></pre></div>
<p>npm will check for a <code>package-lock.json</code> file to install the modules. If no lock file is available, it would read from the <code>package.json</code> file to determine the installations. It is usually quicker to install from <code>package-lock.json</code>, since the lock file contains the exact version of modules and their dependencies, meaning npm does not have to spend time figuring out a suitable version to install.</p>
<p>When deploying to production, you may want to skip the development dependencies. Recall that development dependencies are stored in the <code>devDependencies</code> section of <code>package.json</code>, and have no impact on the running of your app. When installing modules as part of the deployment process to deploy your application, omit the dev dependencies by running:</p>
<divclass="codehilite"><pre><span></span><code>npm i --production
</code></pre></div>
<p>The <code>--production</code> flag ignores the <code>devDependencies</code> section during installation. For now, stick with your development build. </p>
<p>Before moving to the next section, return to the <code>locator</code> folder:</p>
<p>So far, you have been installing npm modules for the <code>locator</code> project. npm also allows you to install packages <em>globally</em>. This means that the package is available to your user in the wider system, like any other shell command. This ability is useful for the many Node.js modules that are CLI tools.</p>
<p>For example, you may want to blog about the <code>locator</code> project that you’re currently working on. To do so, you can use a library like <ahref="https://hexo.io">Hexo</a> to create and manage your static website blog. Install the Hexo CLI globally like this:</p>
<divclass="codehilite"><pre><span></span><code>npm i hexo-cli -g
</code></pre></div>
<p>To install a package globally, you append the <code>-g</code> flag to the command.</p>
<p><$>[note]
<strong>Note</strong>: If you get a permission error trying to install this package globally, your system may require super user privileges to run the command. Try again with <code>sudo npm i hexo-cli -g</code>.
<$></p>
<p>Test that the package was successfully installed by typing:</p>
<p>So far, you have learned how to install modules with npm. You can install packages to a project locally, either as a production or development dependency. You can also install packages based on pre-existing <code>package.json</code> or <code>package-lock.json</code> files, allowing you to develop with the same dependencies as your peers. Finally, you can use the <code>-g</code> flag to install packages globally, so you can access them regardless of whether you’re in a Node.js project or not. </p>
<p>Now that you can install modules, in the next section you will practice techniques to administer your dependencies.</p>
<p>A complete package manager can do a lot more than install modules. npm has over 20 commands relating to dependency management available. In this step, you will: </p>
<ul>
<li>List modules you have installed.</li>
<li>Update modules to a more recent version.</li>
<li>Uninstall modules you no longer need.</li>
<li>Perform a security audit on your modules to find and fix security flaws.</li>
</ul>
<p>While these examples will be done in your <code>locator</code> folder, all of these commands can be run globally by appending the <code>-g</code> flag at the end of them, exactly like you did when installing globally.</p>
<h3id="listing-modules">Listing Modules</h3>
<p>If you would like to know which modules are installed in a project, it would be easier to use the <code>list</code> or <code>ls</code> command instead of reading the <code>package.json</code> directly. To do this, enter:</p>
<divclass="codehilite"><pre><span></span><code>npm ls
<p>The <code>--depth</code> option allows you to specify what level of the dependency tree you want to see. When it’s <code>0</code>, you only see your top level dependencies. If you want to see the entire dependency tree, use the <code>--all</code> argument:</p>
<divclass="codehilite"><pre><span></span><code>npm ls --all
<p>It is a good practice to keep your npm modules up to date. This improves your likelihood of getting the latest security fixes for a module. Use the <code>outdated</code> command to check if any modules can be updated:</p>
<p>This command first lists the <code>Package</code> that’s installed and the <code>Current</code> version. The <code>Wanted</code> column shows which version satisfies your version requirement in <code>package.json</code>. The <code>Latest</code> column shows the most recent version of the module that was published.</p>
<p>The <code>Location</code> column states where in the dependency tree the package is located. The <code>outdated</code> command has the <code>--depth</code> flag like <code>ls</code>. By default, the depth is 0.</p>
<p>It seems that you can update <code>eslint</code> to a more recent version. Use the <code>update</code> or <code>up</code> command like this:</p>
<divclass="codehilite"><pre><span></span><code>npm up eslint
</code></pre></div>
<p>The output of the command will contain the version installed:</p>
<p>The npm <code>uninstall</code> command can remove modules from your projects. This means the module will no longer be installed in the <code>node_modules</code> folder, nor will it be seen in your <code>package.json</code> and <code>package-lock.json</code> files. </p>
<p>Removing dependencies from a project is a normal activity in the software development lifecycle. A dependency may not solve the problem as advertised, or may not provide a satisfactory development experience. In these cases, it may better to uninstall the dependency and build your own module.</p>
<p>Imagine that <code>axios</code> does not provide the development experience you would have liked for making HTTP requests. Uninstall <code>axios</code> with the <code>uninstall</code> or <code>un</code> command by entering:</p>
<divclass="codehilite"><pre><span></span><code>npm un axios
<p>This shows that you have successfully uninstalled the <code>axios</code> package.</p>
<h3id="auditing-modules">Auditing Modules</h3>
<p>npm provides an <code>audit</code> command to highlight potential security risks in your dependencies. To see the audit in action, install an outdated version of the <ahref="https://github.com/request/request">request</a> module by running the following:</p>
<spanclass="na">npm WARN deprecated cryptiles@2.0.5: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated sntp@1.0.9: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated boom@2.10.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated node-uuid@1.4.8: Use uuid module instead</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated har-validator@1.8.0: this library is no longer supported</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated hoek@2.16.3: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated request@2.60.0: request has been deprecated, see https://github.com/request/request/issues/3142</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated hawk@3.1.3: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.</span><spanclass="w"></span>
<spanclass="na">added 56 packages, and audited 139 packages in 4s</span><spanclass="w"></span>
<spanclass="na">13 packages are looking for funding</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="na">run `npm fund` for details</span><spanclass="w"></span>
<p>You can see the path of the vulnerability, and sometimes npm offers ways for you to fix it. You can run the update command as suggested, or you can run the <code>fix</code> subcommand of <code>audit</code>. In your shell, enter:</p>
<spanclass="na">npm WARN deprecated har-validator@5.1.5: this library is no longer supported</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.</span><spanclass="w"></span>
<spanclass="na">npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142</span><spanclass="w"></span>
<spanclass="na">added 19 packages, removed 34 packages, changed 13 packages, and audited 124 packages in 3s</span><spanclass="w"></span>
<spanclass="na">14 packages are looking for funding</span><spanclass="w"></span>
<spanclass="w"></span><spanclass="na">run `npm fund` for details</span><spanclass="w"></span>
<p>npm was able to safely update two of the packages, decreasing your vulnerabilities by the same amount. However, you still have three deprecations in your dependencies. The <code>audit fix</code> command does not always fix every problem. Although a version of a module may have a security vulnerability, if you update it to a version with a different API then it could break code higher up in the dependency tree.</p>
<p>As mentioned before, this is not recommended unless you are sure that it won’t break functionality.</p>
<h2id="conclusion">Conclusion</h2>
<p>In this tutorial, you went through various exercises to demonstrate how Node.js modules are organized into packages, and how these packages are managed by npm. In a Node.js project, you used npm packages as dependencies by creating and maintaining a <code>package.json</code> file—a record of your project’s metadata, including what modules you installed. You also used the npm CLI tool to install, update, and remove modules, in addition to listing the dependency tree for your projects and checking and updating modules that are outdated.</p>
<p>In the future, leveraging existing code by using modules will speed up development time, as you don’t have to repeat functionality. You will also be able to create your own npm modules, and these will in turn will be managed by others via npm commands. As for next steps, experiment with what you learned in this tutorial by installing and testing the variety of packages out there. See what the ecosystem provides to make problem solving easier. For example, you could try out <ahref="https://www.typescriptlang.org/">TypeScript</a>, a superset of JavaScript, or turn your website into mobile apps with <ahref="https://cordova.apache.org/">Cordova</a>. If you’d like to learn more about Node.js, see our <ahref="https://www.digitalocean.com/community/tags/node-js?type=tutorials">other Node.js tutorials</a>.</p>
