How does npm list know which ones are direct dependencies?

Question

Get into a new directly, after typing those three commands:

npm install underscore
npm install lodash
npm install express

I get a node_modules directory with many packages:

$ ls node_modules

accepts              cookie-signature  encodeurl     forwarded    lodash             mime-db      parseurl        send            underscore
array-flatten        debug             escape-html   fresh        media-typer        mime-types   path-to-regexp  serve-static    unpipe
content-disposition  depd              etag          http-errors  merge-descriptors  ms           proxy-addr      setprototypeof  utils-merge
content-type         destroy           express       inherits     methods            negotiator   qs              statuses        vary
cookie               ee-first          finalhandler  ipaddr.js    mime               on-finished  range-parser    type-is

While using npm list, I can get a tree strcture:

$ npm list
/tmp/play/npm
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ ├─┬ [email protected]
│ │ │ └── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ ├── [email protected]
│ │ ├─┬ [email protected]
│ │ │ ├── [email protected]
│ │ │ └── [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ ├── [email protected]
│ └── [email protected]
├── [email protected]
└── [email protected]

My question is: from all those dependencies, how does npm list know which ones are my direct dependencies such as undersocre, lodash and express?

note: I don't have a package.json file.

Answer 1

It builds the list on the basis of the dependencies of the modules. The dependencies of the modules are specified in the package.json of each module in the dependencies field. When you install a module npm adds some additional fields to the module's package.json and one of those is the field _requiredBy to store the dependency link in the other direction as well. If you run the npm list command it goes through all the modules and reads the _requiredBy field in package.json of each module.

If you install a module directly without saving it to your package.json, npm adds #USER to the _requiredBy field to signify that you manually installed it and it is not just a dependency of the other modules. Then npm list shows that module in the root of the tree as well.