npm

advancedwidespread

npm is the package manager and massive online repository of the JavaScript world: with a single command, it downloads and installs reusable code parts written by others.

In plain terms

Imagine you are building furniture, but you do not turn the screws, hinges, and drawer slides yourself, but order them from a huge hardware store. npm is such a store for programmers: it offers millions of ready-made parts, called packages, most of them for free.

The name npm refers to two things at once. One is a command-line program with which developers install packages, and the other is the online repository (registry) from which the packages come.

Because of AI tools, it is no longer only developers who encounter it. Many coding agents and add-ons can be installed via npm, so installation guides often begin with a line starting with 'npm install'.

How it works

The developer lists in one project file (package.json) which packages are needed and which versions.
On the 'npm install' command, the program searches for these in the online repository and downloads them to your machine.
Packages mostly build on additional packages, so npm automatically downloads these dependencies as well. A single installation can thus bring in hundreds of packages.
A lock file (package-lock.json) precisely records which version of what was installed, ensuring the program builds identically on another machine.
Anyone can publish their own package in the repository, and others can then integrate it into their programs.

An everyday example

If you want to try a coding agent, the first step in the guide is to type 'npm install -g' followed by the program name in the terminal. At this point, npm downloads and makes the tool usable on your machine, roughly like your phone's app store installing an app. A key difference is that no one reviews what gets listed in advance, so you should always copy the package name from the creator's official website.

Who is affected

developerA daily working tool: almost every web and JavaScript-based project is built from npm packages. → Code

entrepreneur, executiveYour company's software likely relies on hundreds of external npm packages, and their security is a business risk.

employeeIf you install an AI tool on your work computer, you may easily encounter npm commands, and it is good to know what they do. → Work & HR

parent, student, teacherAnyone learning or teaching web development today encounters it in the first few weeks. → Education & Family

A common misconception

MythAnything on npm has been checked by someone, so it is safe.

In realityAnyone can upload a package to the repository without prior review. Malicious code is regularly uploaded, or a popular package developer's account is compromised.

Limits and risks

Installing a package means running code on your machine, so only install well-known packages from trusted sources.
Scammers often upload malware using misspelled names of popular packages, so a single typo can lead to a bad package.
Due to the chain of dependencies, a single infected small package can reach thousands of programs (supply chain attack).
Coding agents sometimes suggest package names that do not exist or are misspelled, so before installing, check that the package is real and widely used.

Similar, but not the same

Node.js – Node.js is the environment that runs JavaScript programs, while npm is the accompanying package manager that sources components.
pip – Pip serves the same role in the Python language world, with its own separate package repository.
GitHub – GitHub stores and collaboratively develops source code for programs, while npm provides ready-to-install packages for download.

Related concepts

Broader

Package manager, open source, software development

Narrower

npx, package.json, npm-csomag

On the edge

Node.js, pip, GitHub, terminal, supply chain attack

A brief history

npm was created by Isaac Z. Schlueter; its first version was released in 2010 as a Node.js add-on. The company behind npm was acquired in 2020 by GitHub, which is owned by Microsoft.

Where things stand

At the end of 2026, npm is the world's largest software package registry, with millions of packages, and a core tool of web development. Because of the spread of AI tools and supply chain attacks, its security is a prominent topic. After the major attack wave of 2025 (compromised developer accounts, self-propagating malware), its operator GitHub tightened the rules for publishing packages, for example with stronger two-factor authentication and shorter-lived access tokens.

Status: 2026 November

In the news

Appears in 2 Agent Age stories; the curve shows weekly occurrence in the news magazine.

LLM-written PhantomRaven malware steals npm and GitHub credentialsSep 15, 2026 · Code
AI developers targeted with trojans, poisoned instruction files and npm compromiseAug 4, 2026 · Code

Also known as

npm · NPM · Node Package Manager · npm registry · npm-csomag · npm package manager · npm install · npmjs

Sources

npm Docs: About npm

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.