NPM
25 bites tagged NPM — interview questions with model answers, and 60-second explainers.
dependencies vs devDependencies in production?
Dependencies are needed at runtime, devDependencies only for development. npm install includes both, npm ci --only=production excludes dev. understanding package requirements and deployment optimization.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI. Practical dependency hygiene.
Monorepo workspaces vs private npm packages
Workspaces give atomic cross-service changes and instant local linking but couple release cadence; private packages give versioned isolation but add publish overhead and version drift. tradeoffs of code-sharing strategies.
Diamond dependencies and nested node_modules
Npm hoists one version to the top and nests the conflicting version under the dependent package; both coexist on disk. understanding npm's nested install layout.
SemVer and the caret vs tilde range operators
MAJOR.MINOR.PATCH signals breaking/feature/fix; caret allows minor and patch updates, tilde allows only patch; use tilde for tighter control. understanding version ranges.
Why package-lock.json must be committed
Lockfile pins exact versions of the whole dependency tree including transitive deps; guarantees identical installs across machines and CI. understanding reproducible installs.
dependencies vs devDependencies in package.json
Dependencies ship and run in production; devDependencies are only for development; omitted with npm install --production. understanding runtime versus build/test tooling.
Optimize Dockerfile layer caching for npm install
Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest. layer caching mechanics.
Publishing a component to a private NPM registry
Configure package.json fields and scoped name, build dist, set registry auth, npm publish with access restricted. the packaging-to-publish workflow. forgetting the build step or shipping raw source.
Packaging a design system as an npm dependency
Publish to an npm registry, with package.json holding the version, entry points, and dependencies, and version it via SemVer. Distributing shared code as a versioned package.
Versioning and shipping design tokens via NPM
Semver, deprecate-before-delete with aliases, codemods and migration guides. package versioning discipline for a shared dependency. silently renaming tokens and bumping a minor version, breaking every consumer.
How do you add TypeScript types for a library without bundled types?
This tests the DefinitelyTyped @types workflow. Install @types/package as a dev dependency via npm or yarn, skipping it when the library already bundles .d.ts files. A red flag is suggesting manual declarations or extra tooling before checking DefinitelyTyped.
npx: Execute Packages Without Installing Them
npx runs Node.js tools without installing them globally, fetching the latest version on demand. Use it for one-off scaffolding like create-react-app or CI build scripts. The footgun: it may silently run a stale cached copy if you omit a version tag.
Private NPM Registry for Internal Packages
A private registry hosts packages so teams npm install internal design systems like public dependencies. It matters when you split a monolith into shared libraries. The footgun is skipping scoped names and auth, which risks leaking code to the public registry.
Shipping TypeScript Types in package.json
The `types` field in `package.json` tells TypeScript where to find your package's type definitions. Use it when publishing a library to enable autocompletion for users. The footgun is putting type dependencies in `devDependencies` instead of `dependencies`.
DefinitelyTyped: Type Definitions for JavaScript Libraries
@types packages from DefinitelyTyped are instruction manuals for JavaScript libraries, letting TypeScript understand their shapes. You install them for JS libs that lack their own types, enabling autocompletion.
package-lock.json: Your Dependency Blueprint
package-lock.json is a blueprint for your node_modules, ensuring everyone on your team installs the exact same dependency versions. It's auto-generated by npm to prevent 'works on my machine' bugs. The footgun is ignoring it or manually editing it.
Dependency Scanning with npm audit
Think of dependency scanning as a background check for your code. `npm audit` compares your project's packages against a database of known security flaws, telling you if you're using vulnerable code. The biggest footgun is blindly running `npm audit fix`.
NPM Scopes: Namespacing Packages to Avoid Collisions
NPM scopes act like a personal folder for your packages, using the `@scope/package` format to avoid name collisions. They are essential for publishing private packages for your team or grouping related public ones.
npm Scripts: Your Project's Command-Line Shortcuts
Think of npm scripts as aliases for your project's common command-line tasks, stored in `package.json`. Use them to run build tools, start servers, or execute tests. The main footgun is forgetting `npm run` for custom scripts like `lint` or `build`.
Dependencies vs. DevDependencies: What's the Difference?
Dependencies are packages your app needs to run in production (like a web framework). DevDependencies are for your development workflow (like a test runner). The footgun is mixing them up, which bloats your production build with unnecessary code.
package.json: The Blueprint for Your Node.js Project
The package.json file is the blueprint for a Node.js project, listing its dependencies and runnable scripts. It's essential for installing libraries (`npm install`) and running tasks (`npm test`).
Package Publishing: Sharing Your Code with the World
Publishing a package is like adding a book to a public library, making your code reusable with one command. It's essential for sharing design system components or utilities. The footgun: accidentally publishing secrets or making a private package public.
ESM vs. CJS: Navigating JavaScript's Module Divide
JavaScript has two module systems: modern, static ESM (`import`) and legacy, dynamic CJS (`require`). When publishing a library, you must support both. The footgun is shipping only ESM, as it breaks downstream projects that still use `require()`.
Get NPM bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.