8:8
 | This article relies too much on references to primary sources. (June 2020) |
 | |
| Original author(s) | Isaac Z. Schlueter. |
|---|---|
| Developer(s) | npm, Inc. (a subsidiary of GitHub,[1] a subsidiary of Microsoft) |
| Initial release | 12 January 2010[2] |
| Stable release | 7.14.0[3] 
/ 20 May 2021 |
| Repository | |
| Written in | JavaScript |
| Platform | Cross-platform |
| Type | Package manager |
| License | Artistic License 2.0 |
| Website | www |
npm (originally short for Node Package Manager)[4] is a package manager for the JavaScript programming language.
npm, Inc. is a subsidiary of GitHub (a subsidiary of Microsoft), that provides hosting for software development and version control with the usage of Git.
npm is the default package manager for the JavaScript runtime environment Node.js. It consists of a command line client, also called npm, and an online database of public and paid-for private packages, called the npm registry. The registry is accessed via the client, and the available packages can be browsed and searched via the npm website. The package manager and the registry are managed by npm, Inc.
npm is written entirely in JavaScript and was developed by Isaac Z. Schlueter as a result of having "seen module packaging done terribly" and with inspiration from other similar projects such as PEAR (PHP) and CPAN (Perl).[5]
left-pad, which many popular JavaScript packages depended on, was unpublished as the result of a naming dispute between Azer Koculu, a self-taught software engineer, and Kik.[7][8] Although the package was republished three hours later,[9] it caused widespread disruption, leading npm to change its policies regarding unpublishing to prevent a similar event in the future.[10]sudo npm on Linux systems would change the ownership of system files, permanently breaking the operating system.[11]eslint-scope package were compromised resulting in a malicious release of eslint-scope, version 3.7.2. The malicious code copied the npm credentials of the machine running eslint-scope and uploaded them to the attacker.[12]event-stream. The malicious package, called flatmap-stream, contained an encrypted payload that stole bitcoins from certain applications. npm administrators removed the offending package.[13][14]is-promise resulted in outage in serverless applications and deployments worldwide by virtue of being a dependency of many big and important applications.[15]npm is included as a recommended feature in the Node.js installer.[16] npm consists of a command line client that interacts with a remote registry. It allows users to consume and distribute JavaScript modules that are available in the registry.[17] Packages in the registry are in CommonJS format and include a metadata file in JSON format.[18] Over 1.3 million packages are available in the main npm registry.[19] The registry does not have any vetting process for submission, which means that packages found there can potentially be low quality, insecure, or malicious.[18] Instead, npm relies on user reports to take down packages if they violate policies by being low quality, insecure, or malicious.[20] npm exposes statistics including number of downloads and number of depending packages to assist developers in judging the quality of packages.[21]
In npm version 6, the audit feature was introduced to help developers identify and fix security vulnerabilities in installed packages.[22] The source of security vulnerabilities were taken from reports found on the Node Security Platform (NSP) and has been integrated with npm since npm's acquisition of NSP.[23]
npm can manage packages that are local dependencies of a particular project, as well as globally-installed JavaScript tools.[24]
When used as a dependency manager for a local project, npm can install, in one command, all the dependencies of a project through the package.json file.[25]
In the package.json file, each dependency can specify a range of valid versions using the semantic versioning scheme, allowing developers to auto-update their packages while at the same time avoiding unwanted breaking changes.[26]
npm also provides version-bumping tools for developers to tag their packages with a particular version.[27] npm also provides the package-lock.json[28] file which has the entry of the exact version used by the project after evaluating semantic versioning in package.json.
There are a number of open-source alternatives to npm for installing modular JavaScript, including ied, pnpm, npmd, and Yarn, the last of which was released by Facebook in October 2016.[29] They are all compatible with the public npm registry and use it by default, but provide different client-side experiences, usually focused on improving performance and determinism compared to the npm client.[30]
At JSConf 2019 npm's former CTO announced a new federated package registry, Entropic, which is aimed at decentralisation of JavaScript commons.[31]
Internally npm relies on the NoSQL Couch DB to manage publicly available data.[32]
The company behind the npm software is npm, Inc, based in Oakland, California. The CEO Bryan Bogensberger who joined the company in July 2018 resigned in September 2019. Before Bogensberger's resignation, npm co-founder Laurie Voss resigned in July 2019.[33]
GitHub announced in March 2020 it is acquiring npm, Inc.[34]
By: Wikipedia.org
Edited: 2021-06-18 12:30:10
Source: Wikipedia.org
