npm Node package manager

Version 12.2.0 · source

Postcard A5 A4 A4 landscape A3 A3 landscape Letter Tabloid

Light · Postcard 102 × 152 mm · PDF

Dark · Postcard 102 × 152 mm · PDF

Ink saver · Postcard 102 × 152 mm · PDF

Light · A5 148 × 210 mm · PDF

Dark · A5 148 × 210 mm · PDF

Ink saver · A5 148 × 210 mm · PDF

Light · A4 210 × 297 mm · PDF

Dark · A4 210 × 297 mm · PDF

Ink saver · A4 210 × 297 mm · PDF

Light · A4 landscape 297 × 210 mm · PDF

Dark · A4 landscape 297 × 210 mm · PDF

Ink saver · A4 landscape 297 × 210 mm · PDF

Light · A3 297 × 420 mm · PDF

Dark · A3 297 × 420 mm · PDF

Ink saver · A3 297 × 420 mm · PDF

Light · A3 landscape 420 × 297 mm · PDF

Dark · A3 landscape 420 × 297 mm · PDF

Ink saver · A3 landscape 420 × 297 mm · PDF

Light · Letter 8.5 × 11 in · PDF

Dark · Letter 8.5 × 11 in · PDF

Ink saver · Letter 8.5 × 11 in · PDF

Light · Tabloid 11 × 17 in · PDF

Dark · Tabloid 11 × 17 in · PDF

Ink saver · Tabloid 11 × 17 in · PDF

Start here

npm install

Install all dependencies

npm install <pkg>

Add a dependency

npm run <script>

Run a package script

npm test

Run the tests

npm ci

Clean install from lockfile

npx <pkg>

Run a package binary

npm outdated

What is behind?

npm audit

Check for vulnerabilities

Concepts

package.json version ranges
package-lock.json exact versions
node_modules installed tree
Scripts build, test, start

Install

npm install

Install all dependencies

Reads package.json and updates the lockfile if needed.

npm install <pkg>

Add a dependency

Saved under dependencies by default.

npm install -D <pkg>

Add a dev dependency

npm ci

Clean install from the lockfile

Deletes node_modules first and never rewrites the lockfile.

npm install <pkg>@<version>

Install a specific version or tag

A tag works too: <pkg>@latest or <pkg>@next.

npm install -g <pkg>

Install globally

npm uninstall <pkg>

Remove a dependency

npm install -E <pkg>

Save an exact version

Skips the ^ range in package.json.

npm ci --omit=dev

Install production deps only

npm install --package-lock-only

Update lockfile only

npm prune

Remove extraneous packages

npm dedupe

Flatten duplicate packages

npm rebuild

Rebuild native addons

Scripts & npx

npm run <script>

Run a package.json script

npm run

List available scripts

npm test

Run the test script

Shorthand for npm run test; npm start works the same.

npm start

Run the start script

npm run <script> -- <args>

Pass arguments to the script

Everything after -- goes to the script, not to npm.

npx <pkg> [args]

Run a package binary

Uses a local binary, else downloads it temporarily.

npm exec -- <cmd>

Run a command from the local tree

npm run <script> --if-present

Skip silently if missing

npm init -y

Create package.json with defaults

npm init <initializer>

Scaffold from a create-* package

npm init vite runs create-vite.

npm pkg set <key>=<value>

Edit package.json from the shell

Inspect & update

npm ls

Show the dependency tree

Add --depth=0 for top-level packages only.

npm ls <pkg>

Who depends on this package?

npm outdated

Show packages with newer versions

npm update

Update within allowed ranges

Respects the ranges in package.json; it will not cross a major version.

npm update -g

Update global packages

npm view <pkg> versions

List published versions

npm view <pkg> version

Latest published version

npm search <term>

Search the registry

npm explain <pkg>

Why is this installed?

npm doctor

Check the environment

npm root -g

Global install directory

Audit

npm audit

List known vulnerabilities

npm audit fix

Apply compatible fixes

Stays within semver; --force may install breaking upgrades.

npm audit --omit=dev

Ignore dev dependencies

npm audit --audit-level=high

Fail only at high severity

Exit code is non-zero when findings reach that level, useful in CI.

npm audit signatures

Verify registry signatures

npm fund

Show funding links

Version & publish

npm version patch

Bump the patch version

Also commits and tags when in a git repo. Use minor or major as needed.

npm version <x.y.z>

Set an exact version

npm version patch --no-git-tag-version

Bump without commit and tag

npm pack --dry-run

Preview the tarball contents

npm login

npm publish

Publish the package

npm publish --access public

Publish a scoped package publicly

Scoped packages default to private.

npm publish --dry-run

Check a publish without sending

npm publish --tag <tag>

Publish under a dist-tag

npm dist-tag ls

List dist-tags

npm deprecate <pkg>@<range>
                    "<msg>"

Mark versions deprecated

npm link

Symlink a local package

Run in the package, then npm link <pkg> in the consumer.

npm whoami

Show the logged-in user

Workspaces

npm install -w <name>

Install in one workspace

npm run <script> -w <name>

Run a script in one workspace

npm run <script> -ws

Run in all workspaces

npm run <script> -ws --if-present

Skip workspaces without the script

npm init -w <dir>

Create a new workspace

npm ls -ws

List workspace packages

Config

npm config list

Show effective settings

npm config get <key>

Read one setting

npm config set <key>=<value>

Write a setting

Goes to the user ~/.npmrc; use --location=project for ./.npmrc.

npm config delete <key>

Remove a setting

npm config set registry <url>

Use another registry

npm cache verify

Check and tidy the cache

npm cache clean --force

Wipe the cache

npm help <term>

Open the docs for a topic

npm <command> -h

Short usage summary

Recipes

New project

npm init -ynpm install expressnpm install -D typescriptnpm pkg set scripts.start="node index.js"

CI install and test

npm cinpm run build --if-presentnpm testnpm audit --audit-level=high

Upgrade, then release

npm outdatednpm updatenpm testnpm version minornpm publish

Typical scripts block

# package.json"scripts": {  "build": "tsc",  "test": "node --test",  "start": "node dist/index.js"}