Daily npm Commands

The commands that carry daily work are smaller than npm's total surface area suggests. Six commands cover most of what you'll type.

npm init creates a project (or npm init -y to skip prompts and accept defaults). npm install with no args installs every dependency listed in package.json; with a package name, it adds that package. The -D flag marks it as a dev dependency (build tools, test runners) — production deps are the default.

npm ci is the CI/CD install. It deletes node_modules, reads package-lock.json exactly, fails if the lockfile is out of sync with package.json, and installs strictly. It's faster and stricter than npm install — use it everywhere automated builds happen.

npm run <script> executes scripts defined in package.json's scripts section. npm test and npm start have shortcuts (no run needed); everything else needs npm run.

npx <tool> downloads and runs a package without installing it. Use it for one-off tools (npx create-react-app, npx tsc --init) so they don't pollute your global install set.

npm audit scans your dependency tree for known vulnerabilities. Run it weekly. npm audit fix applies non-breaking fixes; review the output before committing.

Code

Init, install, add, remove·bash

# New project
npm init -y

# Install everything from package.json
npm install

# Add a runtime dep
npm install express

# Add a dev dep
npm install -D vitest typescript

# Remove
npm uninstall express

CI install — strict, fast, lockfile-respecting·bash

# In a CI script (GitHub Actions, GitLab CI, ...)
npm ci

# Differences from 'npm install':
# - deletes node_modules first
# - installs strictly from package-lock.json (no resolution)
# - fails if package.json and the lockfile disagree
# - faster (no resolution work) and reproducible

Scripts + npx·bash

# Defined in package.json's "scripts"
npm run build
npm run dev
npm test          # shortcut, no 'run' needed
npm start         # shortcut, no 'run' needed

# One-off tools without polluting global installs
npx create-vite my-app
npx tsc --init
npx eslint .

Security + maintenance·bash

# Find vulnerabilities
npm audit

# Apply non-breaking fixes (review before committing!)
npm audit fix

# What's outdated?
npm outdated

# Upgrade interactive (newer npm versions)
npm update

Code

External links

Exercise

Progress

Comments 0