npm (Node Package Manager) is Node's default tool for installing and managing third-party packages (dependencies) and running project scripts. Two files define a project: package.json (the manifest) and package-lock.json (the exact dependency tree).
It records metadata, scripts, and dependencies. The ^4.18.0 is a semver range — ^ allows compatible minor/patch updates (4.x.x but not 5.0.0).
package.json says: express ^4.18.0 (a RANGE — could install 4.18.0 or 4.19.2...)
package-lock.json: express 4.18.2 (the EXACT version + every nested dependency)
The lockfile pins the precise version of every package (including transitive dependencies) that was installed. This guarantees that everyone on the team — and CI, and production — gets the identical dependency tree, preventing "works on my machine" bugs from version drift.
npm install # install all deps from package.json (updates lockfile)
npm install express # add a dependency
npm install -D vitest # add a devDependency
npm ci # install EXACTLY from the lockfile (used in CI — fast, strict)
npm run dev # run a script defined in package.json
npm ci (vs npm install) installs strictly from the lockfile without modifying it — the correct command for CI/production reproducibility.
✓ ALWAYS commit package-lock.json → reproducible installs across the team & CI
npm and these two files are the foundation of every Node project.
Understanding package.json (dependencies vs devDependencies, semver ranges, scripts) and especially why the lockfile exists (deterministic, reproducible installs of the entire dependency tree) is essential — committing the lockfile and using npm ci in CI prevents subtle, hard-to-debug failures caused by teammates or production getting different package versions.