npm: fundamentals, package manager for React Native and Node.js

What is npm — the Node.js package manager?

npm was created in 2010 by Isaac Schlueter as a solution for managing Node.js dependencies. Since 2014 npm has been managed by npm, Inc., acquired by Microsoft/GitHub in 2020. The tool consists of two parts: the CLI (command line) for installing and managing packages, and the Registry — the central repository of all published modules at registry.npmjs.org.

The npm Registry is the largest package registry: over 2 million packages and more than 10 billion downloads monthly. Each package has a SemVer version, description, dependencies, license, and authorship. Publishing your own package is done via npm publish. npm supports scoped packages for organizations (@scope/package), private registries, and built-in security auditing.

Node.js version 18+ includes npm 9+ with improved performance, workspaces for monorepos, and a reworked peer dependencies mechanism. The npm ecosystem covers server-side JavaScript, frontend (React, Vue, Angular), mobile development (React Native), build tools (Webpack, Vite), and CLI utilities. npm is the primary distribution channel for JavaScript libraries.

Key npm Features

npm install — the main command that reads package.json and package-lock.json to install all dependencies into node_modules. On first run, npm computes the dependency graph, resolves version conflicts, and generates package-lock.json. The npm install <package> command installs a specific package; the --save-dev flag adds it to devDependencies, --global installs globally.

npx — a package runner included in npm since version 5.2. npx allows running CLI utilities without global installation: npx react-native init or npx create-react-app my-app. npx downloads the package to a temporary cache, runs it, and cleans up after completion. npx is also useful for running specific tool versions.

npm audit scans the dependency tree for known vulnerabilities from the npm database. The command outputs a report with severity levels (critical, high, moderate) and recommends npm audit fix to automatically update vulnerable packages. npm cache stores downloaded packages locally. npm cache clean --force clears the cache when installation issues arise. npm outdated shows outdated packages.

# Basic npm commands
$ npm install
$ npm install react-native-webview --save
$ npm install typescript --save-dev
# Running without global installation
$ npx react-native init MyApp
# Security audit
$ npm audit --fix

package.json Structure and Dependency Management

package.json is a JSON file in the project root that describes its metadata, dependencies, and configuration. Required fields: name (unique package name) and version (SemVer version, e.g. 1.0.0). The file is created with npm init -y for quick initialization or manually.

Semantic Versioning (SemVer) is a versioning standard in MAJOR.MINOR.PATCH format. The major version changes with incompatible API changes, the minor version changes when adding functionality (backward compatible), and the patch version changes for bug fixes. The ^ symbol before a version allows minor and patch updates, while ~ allows only patch updates.

{
  "name": "my-app",
  "version": "1.0.0",
  "private": true,
  "scripts": {
    "start": "expo start",
    "android": "expo start --android",
    "ios": "expo start --ios"
  },
  "dependencies": {
    "react": "^18.3.0",
    "react-native": "^0.76.0"
  },
  "devDependencies": {
    "typescript": "^5.5.0",
    "@types/react": "^18.3.0"
  }
}

npm in React Native Development

React Native projects actively use npm for dependency management. The standard set includes react, react-native, navigation libraries (React Navigation), HTTP libraries (axios), state management (Redux, Zustand), and UI components. npm allows installing thousands of compatible packages from the registry.

npx pod-install — a required command after installing native modules in React Native for iOS. npm automatically generates a Podfile.lock based on package-lock.json. In Expo projects, expo install is used instead of npm install, as it selects versions compatible with the current Expo SDK version.

Version conflicts are a common issue in React Native: react-native-reanimated, react-native-gesture-handler, and react-native-safe-area-context require aligned versions. The solution is to update all packages to the latest compatible versions or use --legacy-peer-deps. package-lock.json is critical for native modules compiled via CocoaPods and Gradle.

npm vs Alternative Package Managers

npm is the standard package manager included with Node.js. The main alternatives: yarn (created by Facebook in 2016) and pnpm (fast, with hard links). Since npm 5, the difference in speed and functionality between npm and yarn is minimal. npm 7+ added workspaces, making it competitive for monorepos.

According to State of JS 2025: 62% of developers use npm, 35% use yarn (mostly older projects and PnP enthusiasts), and 3% use pnpm. For React Native projects, both tools are equally viable, but npm is more common in projects using Expo SDK 50+ and new React Native initializations.

yarn retains its advantage in extremely large monorepos (100+ packages) thanks to its more mature workspaces implementation and Plug'n'Play. pnpm wins in disk space savings through hard links to a global store. The choice of manager depends on team preferences and infrastructure.