Comprehensive Guide to npm Configuration Settings

Last update on July 16 2024 13:04:14 (UTC/GMT +8 hours)

This article is going to cover more than what you thought the npm configuration consists of.

Description

The configuration values for npm is gotten from the following sources, these sources are sorted by priority:

Command line Flags

When you put - -foo bar on the command line, the foo configuration will be set to ?bar?. A - - argument will tell the cli parser to stop reading flags. When you use - -flag without specifying any value, will make the value to be set to true.

Example: - -name1 - -name2 will set both configuration parameters to true, while - -name1 - -name2 will set name1 to true, and name2 to bar. Finally, - -name1 - -name2 - -bar will set both configuration parameters to true, and the bar is taken as a command argument.

Environment Variables

Any environment variables that start with npm_config_ is interpreted as a configuration parameter. For instance, when you put npm_config_foo=bar in your environment, it will set the foo configuration parameter to bar. Any environment configurations that you do not given a value will be given the value of true. The config values are case-insensitive, so NPM_CONFIG_FOO=bar works the same as the lowercase version shown earlier. However, it should be noted that inside npm-scripts npm sets its own environment variables and Node prefers those lowercase versions over any uppercase ones that you might set.

It should also be observed that you need to use underscores instead of dashes, so --allow-same-version will be npm_config_allow_same_version=true.

npmrc Files

npmrc has four relevant files which are:

The per-project configuration file (/path/to/my/project/.npmrc)
The per-user configuration file (defaults to $HOME/.npmrc; configurable via CLI option --userconfig or environment variable $NPM_CONFIG_USERCONFIG)
global configuration file (defaults to $PREFIX/etc/npmrc; configurable via CLI option --globalconfig or environment variable $NPM_CONFIG_GLOBALCONFIG)
npm's built-in configuration file (/path/to/npm/npmrc)

Default Configs

you should run npm config ls ?l to see a list of configuration parameters that are internal to npm, which are defaults if nothing else is specified.

Shorthands and Other Niceties

The following shorthands will be parsed on the command line:

-v: --version
-h, -?, --help, -H: --usage
-s, --silent: --loglevel silent
-q, --quiet: --loglevel warn
-d: --loglevel info
-dd, --verbose: --loglevel verbose
-ddd: --loglevel silly
-g: --global
-C: --prefix
-l: --long
-m: --message
-p, --porcelain: --parseable
-reg: --registry>
-f: --force
-desc: --description
-S: --save
-P: --save-prod
-D: --save-dev>
-O: --save-optional
-B: --save-bundle
-E: --save-exact
-y: --yes
-n: --yes false
ll and la commands: ls -long

in the case where the configuration parameters resolve to a known configuration parameter unambiguously, then it will be expanded to that configuration parameter. For instance:

npm ls --par
# same as:
npm ls ?parseable

If you string multiple single-character short-hands together, and you have a resulting combination that is unambiguously not some other configuration param, then it will be expanded to its various component pieces. For instance:

npm ls -gpld
# same as:
npm ls --global --parseable --long --loglevel info

Per-Package Config Settings

When you are running scripts (see npm-scripts) the package.json "config" keys will be overwritten in the environment if there is a config param of <name>[@<version>]:<key>. For instance, if the package.json is as shown:

{ "name" : "bar"
, "config" : { "port" : "8081" }
, "scripts" : { "start" : "node serve.js" } }

and the serve.js is:

http.createServer(...).listen(process.env.npm_package_config_port)

then the user will be able to change the behavior by doing:

npm config set bar:port 80

Config Settings

access

Default: restricted
Type: Access

When you are publishing scoped packages, the access level is restricted by default. If you need your scoped package to be publicly viewable (and installable) you should set --access=public. The only valid values for access are restricted and public. Unscoped packages will always have an access level of public.

allow-same-version

Default: false
Type: Boolean

This will prevent npm from throwing an error when npm version is used to set the new version to the same value as the current version.

always-auth

Default: false
Type: Boolean

This will force npm to always require authentication when accessing the registry, even for GET requests.

also

Default: null
Type: String

When you are in "dev" or "development" and you are running local npm shrinkwrap, npm outdated, or npm update, is an alias for --dev.

audit

Default: true
Type: Boolean

When this is set to "true", it will submit audit reports alongside npm install runs to the default registry and all registries that are configured for scopes.

audit-level

Default: "low"
Type: 'low', 'moderate', 'high', 'critical'

This is the minimum level of vulnerability for npm audit to exit with a non-zero exit code.

auth-type

Default: 'legacy'
Type: 'legacy', 'sso', 'saml', 'oauth'

This defines the authentication strategy to use with adduser/login.

bin-links

Default: true
Type: Boolean

This will tell npm to create symlinks (or .cmd shims on Windows) for package executables.

You should set this to false to have it not do this. You can also use this to work around the fact that some file systems do not support symlinks, even on ostensibly Unix systems.

browser

Default: OS X: "open", Windows: "start", Others: "xdg-open"
Type: String

This is the browser that is called by the npm docs command to open websites.

Default: The npm CA certificate
Type: String, Array or null

This is the Certificate Authority signing certificate that is trusted for SSL connections to the registry. The values should be in PEM format (Windows calls it "Base-64 encoded X.509 (.CER)") with newlines replaced by the string "\n". For example:

ca="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"

Set to null to only allow "known" registrars, or to a specific CA cert to trust only that specific signing authority.

You can trust multiple CAs trusted by specifying an array of certificates:

ca[]="..."
ca[]="..."

cafile

Default: null
Type: path

This is a path to a file that contains one or multiple Certificate Authority signing certificates. This is similar to the ca setting, but will allow for multiple CA's, as well as for you to store the CA information in a file on disk.

cache

Default: Windows: %AppData%\npm-cache, Posix: ~/.npm
Type: path

This is the location of npm's cache directory.

cache-lock-stale

Default: 60000 (1 minute)
Type: Number

This is the number of ms before cache folder lockfiles are considered stale.

cache-lock-retries

Default: 10
Type: Number

This is the number of times to retry to acquire a lock on cache folder lockfiles.

cache-lock-wait

Default: 10000 (10 seconds)
Type: Number

This is the number of ms to wait for cache lock files to expire.

cache-max

Default: Infinity
Type: Number

DEPRECATED: npm has deprecated this option in favor of --prefer-online.

--cache-max=0 is an alias for --prefer-online.

cache-min

Default: 10
Type: Number

DEPRECATED: npm has deprecated this option in favor of --prefer-offline.

--cache-min=9999 (or bigger) is an alias for --prefer-offline.

cert

Default: null
Type: String

The cert is a client certificate to pass when accessing the registry. The values have to be in PEM format (Windows calls it "Base-64 encoded X.509 (.CER)") with newlines replaced by the string "\n". For example:

cert="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"

The cert is not the path to a certificate file (and there is no "certfile" option).

cidr

Default: null
Type: String, Array, null

This is a list of CIDR address that should be used when configuring limited access tokens with the npm token create command.

color

Default: true
Type: Boolean or "always"

When this is set to false, npm will never show colors. If set to "always" then npm always shows colors. If set to true, npm will only prints color codes for tty file descriptors.

You can also change this option using the environment: when you set the environment variable NO_COLOR to any value is set to 0, colors are disabled.

depth

Default: Infinity
Type: Number

This is the depth to go when recursing directories for npm ls, npm cache ls, and npm outdated.

For npm outdated, a setting of Infinity is treated as 0 since that gives more useful information. If you want to show the outdated status of all packages and dependents, you should use a large integer value, e.g., npm outdated --depth 9999

description

Default: true
Type: Boolean

This will show the description in npm search

dev

Default: false
Type: Boolean

Install dev-dependencies along with the packages.

dry-run

Default: false
Type: Boolean

This indicates that you don't want npm to make any changes and it should only report what it would have done. You can pass this into any of the commands that modify your local installation, eg, install, update, dedupe, uninstall. This command is NOT currently honored by some network related commands, eg dist-tags, owner, etc.

editor

Default: EDITOR environment variable if it set, or "vi" on Posix, or "notepad" on Windows.
Type: path

The command to run for npm config edit or npm edit.

engine-strict

Default: false
Type: Boolean

If you set this to true, then npm will not install (or even consider installing) any package that claims not be compatible with the current Node.js version.

force

Default: false
Type: Boolean

This will make various commands more forceful.

lifecycle script failure will not block progress.
When publishing clobbers previously published versions.
skips cache when you are requesting from the registry.
Will prevent checks against clobbering non-npm files.

fetch-retries

Default: 2
Type: Number

The "retries" config for the retry module that is to be used when fetching packages from the registry.

fetch-retry-factor

Default: 10
Type: Number

The "factor" config for the retry module that is to be used when fetching packages.

fetch-retry-mintimeout

Default: 10000 (10 seconds)
Type: Number

The "minTimeout" config for the retry module that is to be used when fetching packages.

fetch-retry-maxtimeout

Default: 60000 (1 minute)
Type: Number

The "maxTimeout" config for the retry module that is to be used when fetching packages.

git

Default: "git"
Type: String

This is command used to perform git commands. If you have git installed on the computer, but it is not in the PATH, then you should set this to the full path to the git binary.

git-tag-version

Default: true
Type: Boolean

Tag the commit when you are using the npm version command.

commit-hooks

Default: true
Type: Boolean

You should run git commit hooks when using the npm version command.

global

Default: false
Type: Boolean

This operates in "global" mode, so that the packages will be installed into the prefix folder instead of the current working directory.

packages will be installed into the {prefix}/lib/node_modules folder, rather than the current working directory.
bin files will be linked to {prefix}/bin
man pages will be linked to {prefix}/share/man

globalconfig

Default: {prefix}/etc/npmrc
Type: path

This is the config file that reads global config options.

global-style

Default: false
Type: Boolean

This command causes npm to install the package into your local node_modules folder with the same layout that it uses with the global node_modules folder. Only your direct dependencies show in node_modules and everything they depend on are flattened in their node_modules folders. This obviously eliminates some deduping. If used with legacy-bundling, legacy-bundling is preferred.

group

Default: GID of the current process
Type: String or Number

This is the group to use when running package scripts in global mode as the root user.

heading

Default: "npm"
Type: String

This is the string that starts all the debugging log output.

https-proxy

Default: null
Type: url

This is a proxy to use for outgoing https requests. In the case where you set the HTTPS_PROXY or https_proxy or HTTP_PROXY or http_proxy environment variables, proxy settings are honored by the underlying request library.

if-present

Default: false
Type: Boolean

If true, npm won?t exit with an error code when run-script is invoked for a script that is not defined in the scripts section of package.json. This option can be used when it is desirable to optionally run a script when it is present and will fail if the script fails. This is useful, for instance, when you are running scripts that may only apply for some builds in an otherwise generic CI setup.

ignore-prepublish

Default: false
Type: Boolean

If you set this to true, npm won?t run prepublish scripts.

ignore-scripts

Default: false
Type: Boolean

Scripts specified in the package.json will not be run by npm if you set this to true.

init-module

Default: ~/.npm-init.js
Type: path

This is a module that is loaded by the npm init command.

init-author-name

Default: ""
Type: String

This is the value npm init should use by default for the package author's name.

init-author-email

Default: ""
Type: String

This is the value npm init should use by default for the package author's email.

init-author-url

Default: ""
Type: String

This is the value npm init should use by default for the package author's homepage.

init-license

Default: "ISC"
Type: String

This is the value npm init should use by default for the package license.

init-version

Default: "1.0.0"
Type: semver

This is the value that npm init should use by default for the package version number, if it is not already set in package.json.

json

Default: false
Type: Boolean

This determines whether to output JSON data instead of the normal output.

This is currently an experimental feature, and the output data structures for many commands is either not yet implemented in JSON, or is subject to change. Currently, it is just the output from npm ls --json and npm search --json are valid.

key

Default: null
Type: String

This is a client key to pass when accessing the registry. The values should be in PEM format with newlines replaced by the string "\n". For example:

key="-----BEGIN PRIVATE KEY-----\nXXXX\nXXXX\n-----END PRIVATE KEY-----"

The key command is not the path to a key file (and there is no "keyfile" option).

legacy-bundling

Default: false
Type: Boolean

This will cause npm to install the package such that versions of npm prior to 1.4, like the one included with node 0.8, will be able to install the package. This will eliminate all automatic deduping. If this is used with global-style this option will be preferred.

link

Default: false
Type: Boolean

Local installs will link if there is a suitable globally installed package, if you set this to true.

Note that this will mean that local installs can cause things to be installed into the global space at the same time. The link is only done when one of the two conditions are met:

When the package is not already installed globally, or
When the globally installed version is identical to the version that is being installed locally.

local-address

Default: undefined
Type: IP Address

This is the IP address of the local interface to use when making connections to the npm registry. It must be IPv4 in versions of Node prior to 0.12.

loglevel

Default: "notice"
Type: String

Values: "silent", "error", "warn", "notice", "http", "timing", "info", "verbose", "silly"

These are the level of logs to report. If it fails, all logs will be written to npm-debug.log in the current working directory.

Any logs that has a higher level than the setting are shown. "notice" is the default.

logstream

Default: process.stderr
Type: Stream

This is the stream passed to the npmlog module at run time.

You cannot set it from the command line, however, if you are using npm programmatically, you may want to send logs to somewhere other than stderr.

When you set the color config to true, this stream will receive colored output if it is a TTY.

logs-max

Default: 10
Type: Number

This is the maximum number of log files to store.

long

Default: false
Type: Boolean

his will show extended information in npm ls and npm search.

maxsockets

Default: 50
Type: Number

This is the maximum number of connections to use per origin (protocol/host/port combination). It is passed to the http Agent used to make the request.

message

Default: "%s"
Type: String

This is the commit message which is used by npm version when creating version commit.

All "%s" in the message will be replaced with the version number.

metrics-registry

Default: The default is the value of registry (which defaults to "https://registry.npmjs.org/")
Type: String

This is the registry that you want to send cli metrics to if send-metrics is true.

node-options

Default: null
Type: String

This is the options to pass through to Node.js via the NODE_OPTIONS environment variable. It does not impact how npm itself is executed however, it does impact how lifecycle scripts are called.

node-version

Default: process.version
Type: semver or false

This is the node version to use when checking a package's engines map.

no-proxy

Default: null
Type: String or Array

This is a comma-separated string or an array of domain extensions that a proxy should not be used for.

offline

Default: false
Type: Boolean

Force offline mode: no network requests are done during install. If you wish to allow the CLI to fill in missing cache data, you should see --prefer-offline.

onload-script

Default: false
Type: path

This is a node module to require() when npm loads. It is useful for programmatic usage.

only

Default: null
Type: String

When "development" or "dev" and you are running local npm install without any arguments, only devDependencies (and their dependencies) will be installed.

Whenever "dev" or "development" and you are running local npm ls, npm outdated, or npm update, it is an alias for --dev.

When "production" or "prod" and you are running local npm install without any arguments, only non-devDependencies (and their dependencies) will be installed.

When "production" or "prod" and you are running local npm ls, npm outdated, or npm update, it is an alias for --production.

optional

Default: true
Type: Boolean

This will attempt to install packages in the optionalDependencies object. It should be noted that if these packages fail to install, then the overall installation process will not be aborted.

otp

Default: null
Type: Number

This is a one-time password gotten from a two-factor authenticator. It is needed when publishing or when changing package permissions with npm access.

package-lock

Default: true
Type: Boolean

If you set this to false, you should ignore package-lock.json files when installing. This also prevents writing package-lock.json if save is true.

Whenever package package-locks are disabled, automatic pruning of extraneous modules are also disabled. If you want to remove extraneous modules with package-locks disabled, you should use npm prune.

This is an alias for --shrinkwrap.

package-lock-only

Default: false
Type: Boolean

If set this option to true, it will only update the package-lock.json, rather than checking node_modules and downloading the dependencies.

parseable

Default: false
Type: Boolean

This will output parseable results from commands that write to standard output. For npm search, this is tab-separated table format.

prefer-offline

Default: false
Type: Boolean

If this option is set to true, staleness checks for cached data are bypassed, but missing data are requested from the server. if you want to force full offline mode, you should use --offline.

This is effectively equivalent to --cache-min=9999999.

prefer-online

Default: false
Type: Boolean

If you set this option to true, staleness checks for cached are forced, and this makes the CLI to look for updates immediately even for fresh package data.

prefix

Default: see npm-folders
Type: path

This is location to install global items. If you set this on the command line, then it will force non-global commands to run in the specified folder.

preid

Default: ""
Type: String

This is the "prerelease identifier" to use as a prefix for the "prerelease" part of a semver. Such as the rc in 1.2.0-rc.8.

production

Default: false
Type: Boolean

You should set to true to run in "production" mode.

devDependencies will not be installed at the topmost level when running local npm install without any arguments.
Ensure that you set the NODE_ENV="production" for lifecycle scripts.

progress

Default: true, unless TRAVIS or CI env vars set.
Type: Boolean

When you set this option to true, npm displays a progress bar during time intensive operations, if process.stderr is a TTY.

You should set this option to false to suppress the progress bar.

proxy

Default: null
Type: url

This is a proxy to use for outgoing http requests. If you set the HTTP_PROXY or http_proxy environment variables, proxy settings are honored by the underlying request library.

read-only

Default: false
Type: Boolean

This is used to mark a token as unable to publish when you are configuring limited access tokens with the npm token create command.

rebuild-bundle

Default: true
Type: Boolean

This will rebuild bundled dependencies after installation.

registry

Default: https://registry.npmjs.org/
Type: url

This is the base URL of the npm package registry.

rollback

Default: true
Type: Boolean

This will remove all failed installs.

save

Default: true
Type: Boolean

This option will save installed packages to a package.json file as dependencies.

When use this with the npm rm command, npm will remove it from the dependencies object.

The option only works if there is already a package.json file present.

save-bundle

Default: false
Type: Boolean

In the case where a package would be saved at install time by the use of --save, --save-dev, or --save-optional, then you also have to put it in the bundleDependencies list.

When you use this with the npm rm command, npm will remove it from the bundledDependencies list.

save-prod

Default: false>
Type: Boolean

his ensures that a package will be saved into dependencies specifically. This will be useful if a package already exists in devDependencies or optionalDependencies, but you wish to move it to be a production dep. This will also be the default behavior if --save is true, and neither --save-optional nor --save-dev are true.

save-dev

Default: false
Type: Boolean

This will save installed packages to a package.json file as devDependencies.

When this is used with the npm rm command, npm will remove it from the devDependencies object.

It only works if there is already a package.json file present.

save-exact

Default: false
Type: Boolean

Dependencies that are saved to package.json using --save, --save-dev or --save-optional are configured with an exact version instead of using npm's default semver range operator.

save-optional

Default: false
Type: Boolean

This option will save installed packages to a package.json file as optionalDependencies.

When this is used with the npm rm command, npm will remove it from the devDependencies object.

his will only work if there is already a package.json file present.

save-prefix

Default: '^'
Type: String

This option configures how versions of packages installed to a package.json file via --save or --save-dev get prefixed.

For example, if a package has version 1.2.4, by default its version is set to ^1.2.4 which will allow minor upgrades for that package, but after you run npm config set save-prefix='~' it will be set to ~1.2.4 which only will only allow patch upgrades.

scope

Default: the scope of the current project, if any, or ""
Type: String

This option will associate an operation with a scope for a scoped registry. It is useful when logging in to a private registry for the first time: npm login --scope=@organization --registry=registry.organization.com, which causes @organization to be mapped to the registry for future installation of packages specified according to this pattern; @organization/package.

script-shell

Default: null
Type: path

This is the shell to use for scripts run with the npm run command.

scripts-prepend-node-path

Default: "warn-only"
Type: Boolean, "auto" or "warn-only"

If you set this option to true, you should add the directory in which the current node executable resides to the PATH environment variable when running scripts, even if it means that npm will invoke a different node executable than the one which it is running.

If you set this option to false, you should never modify PATH with that.

If you set it to "warn-only", you should never modify PATH, rather, you should print a warning if npm thinks that you may want to run it with true, e.g. this is because the node executable in the PATH is not the one npm was invoked with.

If it is set to auto, only add that directory to the PATH environment variable if the node executable that npm was invoked with and the node executable that is found first on the PATH are different.

searchexclude

Default: ""
Type: String

hese are space-separated options that limit the results from search.

searchopts

Default: ""
Type: String

These are space-separated options that are always passed to search.

searchlimit

Default: 20
Type: Number

These are number of items to limit search results to. It will not apply at all to legacy searches.

searchstaleness

Default: 900 (15 minutes)
Type: Number

This is the age of the cache, in seconds, before you make another registry request when using legacy search endpoint.

send-metrics

Default: false
Type: Boolean

If true, success/failure metrics are reported to the registry stored in metrics-registry. These requests have the number of successful and failing runs of the npm CLI and the time period over which those counts were gathered. No identifying information will be included in these requests.

shell

Default: SHELL environment variable, or "bash" on Posix, or "cmd" on Windows
Type: path

This is the shell to run for the npm explore command.

shrinkwrap

Default: true
Type: Boolean

When you set to false, then ignore npm-shrinkwrap.json files while installing. This also prevents writing npm-shrinkwrap.json if save is true.

This is an alias for --package-lock.

sign-git-commit

Default: false
Type: Boolean

If set this to true, then the npm version command commits the new package version using -S to add a signature.

Note that git will require that you to have set up GPG keys in your git configs, for this to work properly.

sign-git-tag

Default: false
Type: Boolean

If you set this to true, then the npm version command tags the version using -s to add a signature.

It should be noted that git requires you to have set up GPG keys in your git configs, to work with this properly.

sso-poll-frequency

Default: 500
Type: Number

When this option is used with SSO-enabled auth-types, it will configure how regularly the registry should be polled while the user is completing authentication.

sso-type

Default: 'oauth'
Type: 'oauth', 'saml', or null

If you set this option like this: --auth-type=sso, then the type of SSO is the type to use.

strict-ssl

Default: true
Type: Boolean

This option determines whether or not you have to do SSL key validation when making requests to the registry via https.

tag

Default: latest
Type: String

Whenever you ask npm to install a package and you don't tell it a specific version, it installs the specified tag.

This is also the tag that is added to the package@version specified by the npm tag command, if you don't give an explicit tag.

tag-version-prefix

Default: "v"
Type: String

If this option is set, it will alter the prefix used when tagging a new version when performing a version increment using npm-version. If you want to remove the prefix altogether, you should set it to the empty string: "".

Since other tools may rely on the convention that npm version tags look like v1.0.0, you should only use this property if it is absolutely necessary. Particularly, you should be careful when overriding this setting for public packages.

timing

Default: false
Type: Boolean

If this is set to true, it writes an npm-debug log to _logs and a timing information to _timing.json, both in your cache. The _timing.json is a newline delimited list of JSON objects. You can view it with this json command line: json -g < ~/.npm/_timing.json.

tmp

Default: TMPDIR environment variable, or "/tmp"
Type: path

This is where to store temporary files and folders. All temp files will be deleted on success, but will be left behind on failure for forensic purposes.

unicode

Default: false on windows, true on mac/unix systems with a unicode locale
Type: Boolean

Whenever you set this option to true, npm will use unicode characters in the tree output. When you set it to false, it will use ascii characters to draw trees.

unsafe-perm

Default: this is false if running fail as root, true otherwise
Type: Boolean

You should set this to true to suppress the UID/GID switching when running package scripts. If you set it explicitly to false, then installing as a non-root user will fail.

update-notifier

Default: true
Type: Boolean

You should set this to false to suppress the update notification when using an older version of npm than the latest.

usage

Default: false
Type: Boolean

You should set this to show short usage output (like the -H output) instead of complete help when doing npm-help.

user

Default: "nobody"
Type: String or Number

This is the UID to set to when running package scripts as root.

userconfig

Default: ~/.npmrc
Type: path

This is the location of user-level configuration settings.

umask

Default: 022
Type: An octal numeric string in range 0000..0777 (0..511)

This is the "umask" value to use when setting the file creation mode on files and folders.

Folders and executables will be given a mode which is 0777 masked against this value. Other files will be given a mode which is 0666 masked against this value. Thus, the defaults will be 0755 and 0644 respectively.

user-agent

Default: node/{process.version} {process.platform} {process.arch}
Type: String

This option sets a User-Agent to the request header

version

Default: false
Type: boolean

If this option is true, it will output the npm version and exit successfully.

It is only relevant when specified explicitly on the command line.

versions

Default: false
Type: boolean

If this option is true, it will output the npm version as well as node's process.versions map, and exit successfully.

It is only relevant when specified explicitly on the command line.

viewer

Default: "man" on Posix, "browser" on Windows
Type: path

This is the program to use to view help content.

You should this option to "browser" to view html help content in the default web browser.

Previous: NPM Coding Style Guide: Best Practices and Conventions.
Next: Essential Guide for npm Developers: Packaging and Publishing.