npm - The Package Manager Everyone Uses But Nobody Really Likes

npm does three things: it stores packages in a giant registry, gives you CLI commands to download them, and creates package.json files to track the chaos.

The Three Parts That Make Your Life Complicated

The Registry: A massive database at npmjs.com with over 3.6 million packages. Most are useful, some are complete garbage, and a few mine Bitcoin in the background. Finding the right package is like searching for a needle in a haystack of abandoned repos from 2018.

The CLI Tool: Commands that come with Node.js. npm install downloads packages and their 47 dependencies. npm audit finds 23 "critical" vulnerabilities in your Hello World app. npm run executes scripts that someone else wrote and you're too afraid to read.

package.json: The file that controls everything and breaks constantly. One wrong character and your entire build pipeline dies. Package-lock.json is supposed to make this deterministic, but somehow every team member gets different versions.

How Installations Go Wrong

npm comes with Node.js, which sounds convenient until you realize it installs globally and fights with your system permissions. On Mac/Linux, you'll spend your first day fixing permission errors. On Windows, it just doesn't work half the time.

Want the latest version? npm install -g npm@latest - but prepare for mysterious failures because your old version cached something wrong.

The node_modules Black Hole

npm creates a node_modules folder that starts small and grows like cancer. Install one package? Congratulations, you now have 247 packages eating 500MB of disk space. Need lodash? Great, now you have 15 different versions because every dependency uses a slightly different one.

The "nested dependency model" sounds fancy but really means "download the entire internet and hope your hard drive survives." Each package gets its own copy of everything, which is why your simple React app weighs more than Microsoft Office.

Fun fact: deleting node_modules and running npm install again fixes 90% of npm problems. The other 10% require deleting your entire project and starting over.

The complexity of npm's dependency resolution is like a fractal - zoom into any dependency and you'll find more dependencies, each with their own dependencies, creating an infinite spiral of code you never asked for.

This is why developers constantly evaluate alternatives. The question isn't whether npm is perfect (it's not), but whether the alternatives are worth the switching cost.

npm 11.5.2 was released July 30, 2025. It's faster than npm 10, which isn't saying much since npm 10 was slow as molasses. They fixed some stuff, broke other stuff, and the cycle continues.

Security Theater Gets an Upgrade

npm audit is still mostly useless: It now gives you more detailed explanations of why your Hello World app has 47 "critical" vulnerabilities. Most are in dev dependencies you don't use, but npm audit doesn't care. At least the error messages are longer now.

Package verification: They added signature checking, which sounds great until a popular package breaks because the maintainer forgot to sign it properly. This happened twice in the first month after release.

"Automated security updates": npm will now suggest fixes that break your build in new and creative ways. npm audit fix --force is still the nuclear option that updates everything and prays it works.

Performance: From Terrible to Bad

30% faster installations: npm 11 is indeed faster than npm 10. Your 5-minute install now takes 3.5 minutes. Revolutionary.

Better caching: The cache works better now, which means fewer trips to the registry when you blow away node_modules for the third time today. It still doesn't work offline half the time.

Memory usage: Uses less RAM during installs, so your laptop fans might not sound like a jet engine. Small wins.

Error Messages: Now With More Words

"Improved error messages": They're longer now. Instead of ERESOLVE, you get a paragraph explaining why your package versions are incompatible, followed by the same unhelpful suggestions to delete node_modules.

Dependency conflicts: npm now suggests specific fixes like npm install package@exact-version that work 60% of the time. The other 40% still require Stack Overflow.

Better workspace support: If you're brave enough to use npm workspaces in a monorepo, it breaks slightly less often. pnpm still does this better.

The Bottom Line

npm 11 is npm 10 but with fewer obvious bugs. It's still slow, your node_modules folder still weighs 500MB, and npm audit still thinks everything is a critical security issue. But hey, at least it crashes less often.

The error messages are wordier, the caching works better, and it's marginally faster. If you're stuck with npm (and you probably are), version 11 is an improvement. Just don't expect miracles.

Even with all the improvements, npm is still painfully slow compared to alternatives. Every benchmark shows the same story: npm comes in dead last. The "improved" error messages are longer but not more helpful - you still end up on Stack Overflow looking for someone who's seen ERESOLVE before.

Which brings us to the real npm experience: figuring out what went wrong when it inevitably breaks.