Question 1

What is the difference between dependencies, devDependencies, and peerDependencies?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — assumes basic npm familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The install behavior below came from **actually running** `npm install --save-dev` and a subsequent `npm install --omit=dev` on this machine, not a description of expected behavior. ## 1. Why This Even Matters — A Story First A moving company packs t

Question 2

What is npx and how does it differ from a global install?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js/npm tooling interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The local-resolution behavior below was **actually run** — a real resolved file path, and a real, immediately-checked `npm ls -g` confirming nothing was installed globally, not a description of intended behavior. ## 1. Why This Even Matters — A Story First Borrowing a spec

Question 3

What is Corepack and how does it manage npm, Yarn, and pnpm versions?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js tooling interviews — assumes basic npm/Yarn/pnpm familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The tool's bundled availability was **executed on Node v24.19.0** on this machine. ## 1. Why This Even Matters — A Story First Two chefs are handed the same recipe card. One reads it using a set of measuring spoons calibrated to imperi

Question 4

What is Node.js and why is it popular?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior Node knowledge assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The version numbers below were read directly from a running Node process on this machine, not quoted from memory. ## 1. Why This Even Matters — A Story First Before Node.js, JavaScript lived almost entirely in one place: the browser, running whatev

Question 5

What is `npm` and what are its core functionalities?

Accepted Answer

npm stands for Node Package Manager. It is the default package manager for Node.js and is used for installing, sharing, and managing project dependencies. Its core functionalities include installing packages from the npm registry, managing project metadata in `package.json`, running scripts defined in `package.json`, and publishing your own packages to the registry. It's crucial for building and maintaining Node.js applications efficiently.

Question 6

Explain the purpose of `package.json` and `npm`.

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — no prior npm experience assumed. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The file contents below came from **actually running** `npm init -y` and `npm install` on this machine, not a hand-written example. ## 1. Why This Even Matters — A Story First A shopping list says "a loaf of bread" — not the specific loaf, not whic

Question 7

What is semantic versioning and how do ^, ~, and exact versions behave?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js dependency-management interviews. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Every range check below was **actually run** with the real `semver` package — genuine `true`/`false` results, not a description of the spec. ## 1. Why This Even Matters — A Story First A promise to "only ever make the recipe spicier or add a garnish, never change

Question 8

What does the Node.js `--env-file` flag do, and does it replace dotenv?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js backend interviews — assumes basic `process.env` familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Everything below was **executed against Node v24.19.0** — the raw output is pasted in section 3. ## 1. Why This Even Matters — A Story First For years, every Node tutorial opened the same way: npm install dotenv, then

Question 9

What is the purpose of `package-lock.json`?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js phone screens — assumes basic `package.json`/npm familiarity. **Difficulty:** Easy > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. The lock-file structure below came from **actually running** `npm install` on this machine and reading the real generated file, not a hand-written example. ## 1. Why This Even Matters — A Story First Two bakers are handed the identical

Question 10

What is CSRF and how do you protect a Node.js API against it?

Accepted Answer

**Target Audience:** Engineers preparing for Node.js security interviews — assumes basic cookies and HTTP request familiarity. **Difficulty:** Medium > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term:. Section 3 was **tested live in a real browser** against two actual local origins, not simulated — the exact cookies seen by the server on each request type are pasted in. ## 1. Why This Even Matters — A Story First A guar

NODE.JSDECODED.

Easy

What is the difference between dependencies, devDependencies, and peerDependencies?

What is npx and how does it differ from a global install?

What is Corepack and how does it manage npm, Yarn, and pnpm versions?

What is Node.js and why is it popular?

What is `npm` and what are its core functionalities?

Explain the purpose of `package.json` and `npm`.

What is semantic versioning and how do ^, ~, and exact versions behave?

What does the Node.js `--env-file` flag do, and does it replace dotenv?

Medium

What is CSRF and how do you protect a Node.js API against it?

When would you choose Node.js over other backend technologies?

What are npm workspaces and how do you manage a monorepo with them?

What are the differences between npm, Yarn, and pnpm?

How do you containerize a Node.js app with a small, secure Docker image (multi-stage, distroless)?

What is the built-in node:test runner and how does it compare to Jest and Mocha?

What are some common security best practices in Node.js applications?

What is undici and why is the global fetch built on it in modern Node.js?

Hard

What are Single Executable Applications (SEA) in Node.js?

Why does a containerized Node.js process need special signal handling as PID 1?