npm hosts 2M+ packages. Modern alternatives: pnpm (faster, disk-efficient), yarn, bun. Watch for supply-chain risk — audit dependencies, use lockfiles, review transitive updates. Never install random packages without checking maintainer, downloads, and last-updated date.