After about seven years of front-end work, npm is the one tool that's been in every project I've touched, from AngularJS apps built with Grunt to Angular micro frontends and AI-driven products. What I value most is its reliability and ubiquity. Integration is effortless because every library publishes to it, whether it's Angular, PrimeNG, D3, or Syncfusion, and every build tool and CI pipeline supports it out of the box. Onboarding is just as smooth. It ships with Node, every developer already knows it, and a new teammate can clone a repo, run npm install and npm start, and be productive within minutes. And it's completely free, which makes it an easy standard to adopt across teams without any budget discussion.
I've also watched it mature a lot. Early on, installs were slow and inconsistent across machines, but package-lock.json, npm ci, and performance improvements in later versions made builds genuinely reproducible. Features like workspaces, overrides for patching vulnerable transitive dependencies, and .npmrc configuration for private registries have made it practical for enterprise teams. I've used private registries to share internal component libraries across projects, and npm makes publishing and versioning those packages straightforward with semantic versioning.
Day to day, npm scripts are what I rely on most. They act as a simple, standardized interface for every project, so whether it's npm start, npm test, or npm run build, anyone can pick up a repo and work the same way. I've tried Yarn and pnpm, and they each have their strengths, but npm remains my default because it's stable, well documented, and works everywhere without extra setup. Review collected by and hosted on G2.com.
Honestly, there's not much to complain about when it comes to onboarding, integration, or cost. It's free, it works with everything, and every developer already knows it. My frustrations are mostly around dependency management at scale. The node_modules folder gets huge very quickly, and a single package can pull in hundreds of transitive dependencies you never asked for. Peer dependency conflicts are a regular headache, especially during Angular upgrades, and I've lost count of how many times the fix was --legacy-peer-deps just to get an install to succeed, which always feels like hiding a problem rather than solving it.
Security is the other big concern. Since anyone can publish a package, supply chain risks like compromised or typosquatted packages are real, and one bad transitive dependency can affect your whole app. npm audit helps, but it's noisy and often flags vulnerabilities in dev-only tools that don't actually matter, so teams start ignoring it, which defeats the purpose. Package-lock merge conflicts in busy repos are another small but constant annoyance, and compared to pnpm, npm is still slower and less efficient with disk space. None of these are deal breakers, but they're the reasons dependency hygiene takes real discipline on any long-lived project. Review collected by and hosted on G2.com.
