An npm package is a JavaScript module published to the npm registry so developers can install and reuse it in applications, build tools, and scripts. Packages can contain code, metadata, dependencies, and release information, and they are usually fetched automatically during development or continuous integration.
In cyber security, npm packages matter because they sit in the software supply chain. Attackers may try to compromise a maintainer account, publish a malicious update, or introduce a lookalike package that gets installed by mistake. Defenders reduce this risk by reviewing package provenance, locking dependency versions, monitoring maintainership changes, and scanning for suspicious post-install scripts or unexpected network activity. Because packages are widely reused, a single compromised module can affect many projects at once.