$ npm install express --save

npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN express-app@1.0.0 No description
npm WARN express-app@1.0.0 No repository field.

+ express@4.17.1
added 50 packages from 37 contributors and audited 126 packages in 1.606s
found 0 vulnerabilities 

{
   "name": "express-app",
   "version": "1.0.0",
   "description": "",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "author": "",
   "license": "ISC",
   "dependencies": {
     "express": "4.17.1" //<— 追加されている
   }
 } 

 // app.js
 var express = require('express')
 var app = express()
 
 app.get('/', function (req, res) {
   res.send('Hello World!')
 })
 app.listen(3000) 

 // app.js
 const express = require('express')
 const app = express()
 
 app.get('/', (req, res) => res.send('HelloWorld'))
 app.listen(3000) 

 $ node app.js