Node.js NPM & Package Management 4 — Questions and Answers
Question 1: How do you install a specific version of a package, e.g., lodash version 4.17.15?
- npm install lodash@4.17.15 (Correct answer)
- npm install lodash==4.17.15
- npm install lodash --version=4.17.15
- npm get lodash@4.17.15
Correct answer: npm install lodash@4.17.15
Appending `@version` to the package name tells npm to install that exact version.
Question 2: What is the purpose of `.npmignore`?
- Lists packages to skip during `npm install`
- Specifies files to exclude when publishing a package to the registry (Correct answer)
- Prevents npm from reading certain config files
- Ignores packages in the lock file
Correct answer: Specifies files to exclude when publishing a package to the registry
`.npmignore` lists files and directories that should be omitted from the published package tarball, similar to `.gitignore`.
Question 3: What is a scoped npm package?
- A package limited to a geographic region
- A package whose name is prefixed with `@username/` or `@org/` (Correct answer)
- A package only installable with admin rights
- A package scoped to a specific Node.js version
Correct answer: A package whose name is prefixed with `@username/` or `@org/`
Scoped packages use the `@scope/name` naming convention to namespace packages under a user or organization.
Question 4: Which command shows the full dependency tree of installed packages?
- npm deps
- npm list (Correct answer)
- npm tree
- npm show deps
Correct answer: npm list
`npm list` (or `npm ls`) prints the dependency tree of the current project's node_modules.
Question 5: What does `npm audit fix` do?
- Removes all vulnerable packages
- Automatically updates vulnerable dependencies to patched versions when possible (Correct answer)
- Reports vulnerabilities without making changes
- Generates a security report PDF
Correct answer: Automatically updates vulnerable dependencies to patched versions when possible
`npm audit fix` installs compatible updates for packages with known vulnerabilities, staying within semver ranges defined in package.json.
Question 6: What is the `peerDependencies` field used for in package.json?
- Packages that are optional at runtime
- Packages the consumer of your package must provide themselves (Correct answer)
- Packages shared among workspace members
- Packages only needed during testing
Correct answer: Packages the consumer of your package must provide themselves
`peerDependencies` declares packages that the host project must install; the package itself does not install them to avoid duplicate instances.
Question 7: How do you configure a custom npm registry for a specific scope?
- npm config set registry <url>
- Set `@scope:registry=<url>` in .npmrc (Correct answer)
- npm scope --registry=<url>
- Add registry to package.json under the scope key
Correct answer: Set `@scope:registry=<url>` in .npmrc
Adding `@scope:registry=https://your-registry.com` to `.npmrc` routes only that scope's package installs to the custom registry.
Node.js NPM & Package Management 4
How do you install a specific version of a package, e.g., lodash version 4.17.15?