npm .gitignore template

The package-lock.json rule is the one to change. The lockfile records the exact resolved version and integrity hash of every package in the tree, including transitive dependencies that your manifest never names. It is what makes an install today produce the same tree as an install in six months, and it is what a security audit reads to tell you which exact versions you are running.

Ignoring it means every install resolves fresh against the registry within your declared version ranges. A patch release published overnight silently enters your build, CI tests something slightly different from what you tested locally, and reproducing a bug report becomes guesswork. The current guidance from the tool's own documentation is to commit it, and the only real exception is a published library whose consumers resolve their own tree.

node_modules is the uncontroversial half. It is the installed tree, restored from the manifest and the lockfile, and it is the largest directory in most JavaScript projects by a wide margin. Packages with native components compile during install, so a committed tree is wrong for anyone on a different platform.

npm-debug.log and its numbered variants are written when an install or a script fails. They contain the full command line, the resolved dependency tree at the point of failure and the environment, which makes them useful for one debugging session and useless afterwards.

.npm is the cache directory when the tool is configured to keep it inside the project rather than in the home directory. .eslintcache is a linter cache that stores per file results keyed by content hash, so a rerun only checks what changed.