TodayTools

Publish an npm package flashcards

Ship a JavaScript library people can install, trust and upgrade without fear.

Donate
Beginner friendly, starts from zero
Section
How to study
0
Publish an npm packageStart from zero · 1 of 12

What does it mean to publish an npm , in one plain sentence?

You put a piece of your reusable JavaScript code on the public npm , so anyone, including you, can add it to a project with one command.

Publish once, install anywhere.

All topics

Publish an npm package at a glance

Publishing an npm package puts your reusable JavaScript code online so any project can install it with one command.

Like giving a book to a public library: anyone can borrow a copy, and every new edition gets a new number.

Words you will meet

Package
A folder of code with a name and a version, ready to share
Registry
The online shelf where all public npm packages live
package.json
The small file that holds your package's name, version and settings
Scope
Your own name space, like @vikram, so names do not clash
Version
Three numbers, major.minor.patch, that name each release
Tarball
One packed file holding everything you publish
Token
A temporary key that lets a tool publish for you

The steps

  1. 1. Start from zero (12 cards): What a package is, where npm keeps it, and the words you need before your first publish.
  2. 2. Core basics (15 cards): What a package is, a sound package.json, names and scopes, versions and your first safe publish.
  3. 3. Next steps (15 cards): Exactly which files ship, modern exports and types, dependency types, release scripts, tags, prereleases and cleanup.
  4. 4. Go deeper (15 cards): Tokenless CI publishing, provenance, token policy, ESM and CJS, monorepos, release gates and supply chain defence.
All 12 cards in Start from zero
What does it mean to publish an npm package, in one plain sentence?
You put a piece of your reusable JavaScript code on the public npm registry, so anyone, including you, can add it to a project with one command.
What problem does publishing solve? What was it like before?
Before, you copied the same code files into every project. Each copy slowly changed, and a bug fix had to be made five times. A package keeps one copy that every project updates from.
Where do you already meet npm packages?
Almost every JavaScript website and app is built from npm packages. A typical web app uses hundreds of them for dates, charts, forms and more, often without you noticing.
What everyday thing is publishing a package like?
Like an author giving a book to a public library. Anyone can borrow a copy, the library keeps every edition, and each new edition gets a new number instead of changing the old one.
What are a package, a library and a dependency?
A package is a folder of code with a name and a version, ready to share. A library is a package other code calls into. A dependency is a package your project needs to work.
What are Node.js, npm and the registry?
Node.js runs JavaScript on a computer, outside the browser, and comes with npm, the tool that installs and publishes packages. The registry is the big online shelf at npmjs.com where they all live.
What is package.json?
package.json is your package's ID card in JSON. The name must be unique on npm, and the version says which edition this is. Other fields come later.
What do the three numbers in a version like 2.4.1 mean?
Major, minor and patch. Patch (the last) is a bug fix, minor (the middle) adds something new, and major (the first) means a change that may break people's code.
What are an npm account, two-factor login, a scope and a token?
Your account is your publisher name. Two-factor login asks for a second code from your phone. A scope like @vikram is your own name space, and a token is a temporary key a tool uses to publish for you.
What are Git, a commit, a tag, a README and a tarball?
Git saves the history of your code; a commit is one saved step and a tag is a name on one step, like v1.0.0. A README is the welcome page. A tarball is one packed file of your package.
What do you need, and what is your first tiny win?
Node.js, a text editor, a free npm account and a terminal, the window where you type commands. Run these two lines: if both print a number, you see your Node.js version and npm version and are ready.
What will you be able to do after this topic?
Pick a free name, set up package.json, test the package as users will get it, publish it safely, release fixes with the right version number and automate releases.
Publish an npm package cheatsheet

Account and access

  • npm login Browser sign-in, short session
  • npm whoami Who you are signed in as
  • npm profile enable-2fa auth-and-writes 2FA for login and publish
  • npm access set mfa=publish <pkg> Require 2FA, no tokens, to publish
  • npm owner ls <pkg> Who can publish
  • npm team add acme:release <user> Give a teammate access

Release

  • npm pack --dry-run Files and size that will ship
  • npm version patch|minor|major Bump, commit and tag
  • npm version prerelease --preid beta Next beta number
  • npm publish --access public Publish a public scoped package
  • npm publish --tag next Publish without moving latest
  • git push --follow-tags Push the release commit and tag

After release

  • npm view <pkg> versions --json All published versions
  • npm dist-tag ls <pkg> Where latest and next point
  • npm dist-tag add <pkg>@1.5.1 latest Repoint latest
  • npm deprecate <pkg>@"<1.3.2" "msg" Warn on bad versions
  • npm unpublish <pkg>@<ver> Remove, within the policy window
  • npm audit signatures Verify signatures and provenance

package.json fields

  • "type": "module" .js files are ESM
  • "exports": { ".": { "types", "default" } } Public entry points, types first
  • "files": ["dist"] Allow-list of shipped files
  • "bin": { "invoice": "./dist/cli.js" } Install a command
  • "engines": { "node": ">=22" } Supported Node versions
  • "peerDependencies": { "react": "^19" } User supplies this
  • "sideEffects": false Allow tree-shaking
  • "publishConfig": { "access": "public" } Default publish options

Quality checks

  • npx publint Lint package.json vs tarball
  • npx @arethetypeswrong/cli --pack . Check type resolution modes
  • npm pack && npm i ./pkg-1.0.0.tgz Install the real tarball
  • npx changeset Record a version bump in a PR
  • npm explain <dep> Why a dependency is installed
Donate