npm is the package manager that comes with Node.js. Dependencies are listed in package.json; package-lock.json pins exact versions.
Click any command to copy it.
Project setup
| Command | What it does |
|---|
npm init -y | Create a package.json with defaults. |
node -v && npm -v | Show Node and npm versions. |
npm install | Install all dependencies from package.json. |
npm ci | Clean, exact install from the lockfile (best for CI). |
npm install --omit=dev | Install only production dependencies. |
Add and remove packages
| Command | What it does |
|---|
npm install package | Add a dependency. |
npm install -D package | Add a development dependency. |
npm install package@1.2.3 | Install an exact version. |
npm install package@latest | Install the newest version. |
npm install -g package | Install globally. |
npm uninstall package | Remove a dependency. |
npm ls -g --depth=0 | List globally installed packages. |
npm prune | Remove packages that are not listed in package.json. |
Scripts
| Command | What it does |
|---|
npm run build | Run the build script from package.json. |
npm start | Run the start script. |
npm test | Run the test script. |
npm run | List available scripts. |
npx package | Run a package's command without installing it globally. |
npm run build -- --flag | Pass arguments through to the script. |
Inspect and update
| Command | What it does |
|---|
npm ls --depth=0 | List top-level installed packages. |
npm outdated | Show packages with newer versions. |
npm update | Update within the allowed version ranges. |
npm view package version | Show a package's latest version. |
npm explain package | Explain why a package is installed. |
npm doctor | Check your npm environment for problems. |
npm config get registry | Show the registry in use. |
Security
| Command | What it does |
|---|
npm audit | Report known vulnerabilities in dependencies. |
npm audit fix | Apply compatible fixes automatically. |
npm audit fix --force | Destructive: Apply fixes that may include breaking major upgrades. |
npm audit --omit=dev | Audit only production dependencies. |
Publish and clean up
| Command | What it does |
|---|
npm login | Log in to the registry. |
npm whoami | Show the logged-in user. |
npm version patch | Bump the patch version and create a git tag. |
npm pack | Create the tarball that would be published, to inspect it. |
npm publish | Publish the package (use --access public for scoped public packages). |
npm cache clean --force | Clear the npm cache. |
rm -rf node_modules && npm ci | Reinstall from scratch to fix odd dependency problems. |
Frequently asked questions
What is the difference between npm install and npm ci?
npm install can update the lockfile; npm ci installs exactly what the lockfile says and fails if it does not match package.json, which makes builds reproducible.
What does -D do?
-D (--save-dev) records the package under devDependencies, which are not installed when you use --omit=dev in production.
More Programming & Tooling cheat sheets