NPM
NPM

Init & Config

Interactively create a package.json file

$npm init

Create a package.json file with all defaults, skipping prompts

$npm init -y

Initialize a scoped package interactively

$npm init --scope=@myorg

Set default author name used during npm init

$npm set init-author-name "John Doe"

Set default author email used during npm init

$npm set init-author-email "john@example.com"

Set default license used during npm init

$npm set init-license "MIT"

Set the default npm registry URL

$npm config set registry https://registry.npmjs.org/

Get the currently configured npm registry URL

$npm config get registry

Remove the registry config key, reverting to default

$npm config delete registry

List all active npm configuration values

$npm config list

List all npm config values in JSON format

$npm config list --json

Open the global .npmrc file in the default editor

$npm config edit

Configure npm to save exact versions instead of semver ranges

$npm config set save-exact true

Set the default semver prefix used when saving dependencies

$npm config set save-prefix "~"

Set an HTTP proxy for npm network requests

$npm config set proxy http://proxy.example.com:8080

Set an HTTPS proxy for npm network requests

$npm config set https-proxy http://proxy.example.com:8080

Set a custom directory for the npm cache

$npm config set cache /path/to/cache

Install & Add Packages

Install all dependencies listed in package.json

$npm install

Install only production dependencies, skipping devDependencies

$npm install --production

Install only devDependencies

$npm install --only=dev

Install dependencies without updating package-lock.json

$npm install --frozen-lockfile

Install packages ignoring peer dependency conflicts

$npm install --legacy-peer-deps

Force reinstall of all packages, bypassing cache and lock

$npm install --force

Install packages without running any lifecycle scripts

$npm install --ignore-scripts

Use cached packages when available, falling back to network

$npm install --prefer-offline

Force network fetch even when cached packages are available

$npm install --prefer-online

Install the latest version of the express package as a dependency

$npm install express

Install a specific version of the express package

$npm install express@4.18.2

Install the latest tagged version of the express package

$npm install express@latest

Install express at the latest version satisfying the given semver range

$npm install express@^4.0.0

Install express and explicitly add it to dependencies in package.json

$npm install express --save

Install express and pin the exact version in package.json

$npm install express --save-exact

Install typescript as a development dependency

$npm install typescript --save-dev

Install an exact version of typescript as a devDependency

$npm install typescript --save-dev --save-exact

Install lodash as an optional dependency

$npm install lodash --save-optional

Install typescript globally on the system

$npm install -g typescript

Update npm itself to the latest version globally

$npm install -g npm@latest

Install multiple packages simultaneously as dependencies

$npm install react react-dom

Install a scoped package as a devDependency

$npm install @types/node --save-dev

Install a package directly from a GitHub repository URL

$npm install git+https://github.com/user/repo.git

Install a package from a GitHub shorthand reference

$npm install github:user/repo

Install a package from a specific branch of a GitHub repository

$npm install github:user/repo#branch

Install a package from a local directory path

$npm install ./path/to/local-package

Install a local package using the file: protocol

$npm install file:./packages/my-lib

Install a package from a remote tarball URL

$npm install https://example.com/package.tgz

Install express without modifying package.json

$npm install --no-save express

Simulate installing express without making any actual changes

$npm install --dry-run express

Install express with verbose output for debugging

$npm install --verbose express

Uninstall & Remove Packages

Remove express from node_modules and package.json dependencies

$npm uninstall express

Remove express from node_modules and explicitly remove from dependencies

$npm uninstall express --save

Remove typescript from node_modules and devDependencies

$npm uninstall typescript --save-dev

Remove lodash from node_modules and optionalDependencies

$npm uninstall lodash --save-optional

Remove a globally installed package

$npm uninstall -g typescript

Remove express from node_modules without modifying package.json

$npm uninstall --no-save express

Remove multiple packages simultaneously

$npm uninstall react react-dom

Update Packages

Update all packages to the latest version within their semver range

$npm update

Update express to the latest version within its semver range

$npm update express

Update all packages and persist updated versions to package.json

$npm update --save

Update all globally installed packages

$npm update -g

Update a specific globally installed package

$npm update -g typescript

Update packages up to 2 levels deep in the dependency tree

$npm update --depth 2

Scripts & Execution

Execute the build script defined in package.json scripts

$npm run build

Execute the dev script defined in package.json scripts

$npm run dev

Execute the test script defined in package.json scripts

$npm run test

Execute the lint script defined in package.json scripts

$npm run lint

Execute the format script defined in package.json scripts

$npm run format

Execute the start script defined in package.json scripts

$npm run start

Run the start script shorthand (no run keyword needed)

$npm start

Run the test script shorthand (no run keyword needed)

$npm test

Pass additional arguments to a script after the double-dash separator

$npm run build -- --watch

Run the build script only if it exists, without erroring if absent

$npm run build --if-present

List environment variables available to scripts at runtime

$npm run env

Execute a locally installed binary from node_modules/.bin

$npm exec tsc

Execute a local binary with arguments using the double-dash separator

$npm exec -- tsc --init

Run a package binary without installing it permanently

$npx create-react-app my-app

Run a package binary, auto-confirming installation prompts

$npx --yes create-next-app my-app

Run a local binary only, without fetching from registry if missing

$npx --no-install tsc

Specify a package to install and then run its binary

$npx -p typescript tsc --init

Workspaces

Install dependencies for all workspaces in a monorepo

$npm install --workspaces

Install dependencies for a specific workspace by path

$npm install --workspace=packages/app

Run the build script across all workspaces

$npm run build --workspaces

Run the build script in a specific workspace

$npm run build --workspace=packages/app

Run test script across all workspaces only where it exists

$npm run test --workspaces --if-present

Install a package into a specific workspace

$npm install lodash --workspace=packages/app

Execute a binary in the context of a specific workspace

$npm exec --workspace=packages/app -- tsc

Get the name field from package.json for all workspaces

$npm pkg get name --workspaces

Publish & Registry

Publish the current package to the npm registry

$npm publish

Publish a scoped package publicly to the npm registry

$npm publish --access public

Publish a package as restricted (private)

$npm publish --access restricted

Publish the package under a custom dist-tag instead of latest

$npm publish --tag beta

Simulate publishing without uploading anything to the registry

$npm publish --dry-run

Publish using a one-time password for 2FA-enabled accounts

$npm publish --otp 123456

Remove a specific version of a package from the registry

$npm unpublish my-package@1.0.0

Force-remove an entire package from the registry

$npm unpublish my-package --force

Mark a specific package version as deprecated with a message

$npm deprecate my-package@1.0.0 "Use v2 instead"

Add a dist-tag pointing to a specific version

$npm dist-tag add my-package@1.0.0 stable

Remove a dist-tag from a package

$npm dist-tag rm my-package beta

List all dist-tags for a package

$npm dist-tag ls my-package

Create a .tgz tarball of the current package without publishing

$npm pack

List files that would be included in the tarball without creating it

$npm pack --dry-run

Authentication

Log in to the npm registry interactively

$npm login

Log in to a specific npm registry

$npm login --registry https://registry.npmjs.org/

Associate a scope with a specific registry and log in

$npm login --scope=@myorg

Log out from the npm registry, removing auth tokens

$npm logout

Log out from a specific registry

$npm logout --registry https://registry.npmjs.org/

Display the currently authenticated npm username

$npm whoami

Display the authenticated username for a specific registry

$npm whoami --registry https://registry.npmjs.org/

List all authentication tokens for the current account

$npm token list

Create a new authentication token

$npm token create

Create a read-only authentication token

$npm token create --read-only

Create a token restricted to a specific CIDR IP range

$npm token create --cidr 192.168.1.0/24

Revoke a specific authentication token by its ID or value

$npm token revoke abc123

Listing & Dependency Tree

List installed packages and their dependency tree in the current project

$npm list

List only top-level installed packages without sub-dependencies

$npm list --depth=0

List installed packages up to one level of sub-dependencies

$npm list --depth=1

Output the installed dependency tree in JSON format

$npm list --json

List only production dependencies in the tree

$npm list --production

List only development dependencies in the tree

$npm list --dev

Check if express is installed and show its resolved version

$npm list express

List all globally installed packages

$npm list -g

List top-level globally installed packages only

$npm list -g --depth=0

List the full dependency tree including all nested dependencies

$npm list --all

List only symlinked packages in node_modules

$npm list --link

Audit & Security

Scan installed dependencies for known security vulnerabilities

$npm audit

Output vulnerability audit results as JSON

$npm audit --json

Audit only production dependencies for vulnerabilities

$npm audit --production

Exit with error only if critical severity vulnerabilities are found

$npm audit --audit-level=critical

Exit with error if high or critical severity vulnerabilities are found

$npm audit --audit-level=high

Exit with error if moderate or higher severity vulnerabilities are found

$npm audit --audit-level=moderate

Automatically fix vulnerabilities by updating affected packages

$npm audit fix

Force fix vulnerabilities even if it requires breaking semver changes

$npm audit fix --force

Simulate audit fixes without applying any changes

$npm audit fix --dry-run

Fix vulnerabilities in package-lock.json only without touching node_modules

$npm audit fix --package-lock-only

Versioning

Increment the patch version in package.json and create a git tag

$npm version patch

Increment the minor version in package.json and create a git tag

$npm version minor

Increment the major version in package.json and create a git tag

$npm version major

Increment to the next prepatch prerelease version

$npm version prepatch

Increment to the next preminor prerelease version

$npm version preminor

Increment to the next premajor prerelease version

$npm version premajor

Increment the prerelease number of the current version

$npm version prerelease

Increment the prerelease version with a custom identifier like alpha

$npm version prerelease --preid=alpha

Set an explicit version number in package.json

$npm version 2.0.0

Increment the patch version without creating a git commit or tag

$npm version patch --no-git-tag-version

Increment patch version and use a custom git commit message

$npm version patch -m "chore: release v%s"

Cache

Clear the entire npm cache directory

$npm cache clean --force

Verify the integrity and consistency of the npm cache

$npm cache verify

List cached packages stored in the npm cache directory

$npm cache ls

Linking

Create a global symlink for the current package for local development

$npm link

Link a globally symlinked package into the current project

$npm link my-package

Remove a previously linked package from the current project

$npm unlink my-package

Remove the global symlink created for the current package

$npm unlink

Outdated & Doctor

Check which installed packages have newer versions available

$npm outdated

Output outdated package information as JSON

$npm outdated --json

Check outdated status for top-level packages only

$npm outdated --depth=0

Check for outdated globally installed packages

$npm outdated -g

Run a set of environment checks to verify npm is configured correctly

$npm doctor

Package.json Management

Read the name field from the current package.json

$npm pkg get name

Read the version field from the current package.json

$npm pkg get version

Read all scripts defined in the current package.json

$npm pkg get scripts

Set the name field in package.json

$npm pkg set name="my-app"

Set the version field in package.json

$npm pkg set version="1.0.0"

Add or update a script entry in package.json

$npm pkg set scripts.build="tsc"

Set the minimum required Node.js version in package.json

$npm pkg set engines.node=">=18.0.0"

Remove a specific key from package.json

$npm pkg delete scripts.build

CI & Environment

Install dependencies strictly from package-lock.json for reproducible CI builds

$npm ci

Install only production dependencies from package-lock.json

$npm ci --production

Install from lockfile without running lifecycle scripts

$npm ci --ignore-scripts

Install from lockfile suppressing all output except errors

$npm ci --silent

Install from lockfile using cache where possible

$npm ci --prefer-offline

Organization & Teams

Add a user to an npm organization with the developer role

$npm org set my-org username developer

Add a user to an npm organization with the admin role

$npm org set my-org username admin

Remove a user from an npm organization

$npm org rm my-org username

List all members of an npm organization

$npm org ls my-org

Create a new team within an npm organization

$npm team create my-org:frontend

Delete a team from an npm organization

$npm team destroy my-org:frontend

Add a user to a specific team within an organization

$npm team add my-org:frontend username

Remove a user from a specific team within an organization

$npm team rm my-org:frontend username

List all teams within an npm organization

$npm team ls my-org

List all members of a specific team within an organization

$npm team ls my-org:frontend

Set a package's access level to public

$npm access public my-package

Set a package's access level to restricted (private)

$npm access restricted my-package

Grant read-only access to a team for a specific package

$npm access grant read-only my-org:frontend my-package

Grant read-write access to a team for a specific package

$npm access grant read-write my-org:frontend my-package

Revoke a team's access to a specific package

$npm access revoke my-org:frontend my-package

List all packages accessible to an organization

$npm access ls-packages my-org

List all collaborators with access to a specific package

$npm access ls-collaborators my-package

Miscellaneous

Print the path to the local node_modules directory

$npm root

Print the path to the global node_modules directory

$npm root -g

Print the path to the local .bin executables directory

$npm bin

Print the path to the global bin executables directory

$npm bin -g

Print the nearest parent directory containing a package.json

$npm prefix

Print the global npm prefix directory

$npm prefix -g

Rebuild all native addons for the current Node.js version

$npm rebuild

Rebuild a specific native addon package

$npm rebuild bcrypt

Reduce duplication in the dependency tree by flattening shared packages

$npm dedupe

Remove packages from node_modules that are not listed in package.json

$npm prune

Remove devDependency packages not needed in production

$npm prune --production

Lock down dependency versions by generating an npm-shrinkwrap.json file

$npm shrinkwrap

Display funding information for installed packages

$npm fund

Display funding information for a specific package

$npm fund express

Explain why a package is installed and which packages depend on it

$npm explain express

Output the dependency explanation for a package as JSON

$npm explain express --json

Output a shell completion script for npm commands

$npm completion

Open the documentation page for the npm install command

$npm help install

Search npm help documentation for pages related to a keyword

$npm help-search publish

Display the currently installed version of npm

$npm --version