npm Commands Reference

Installs a package (and its dependencies), adding it to package.json and refreshing package-lock.json. Without arguments, installs everything already declared in the current project's package.json.

Installs a package into the global prefix so its bin scripts are on your PATH system-wide. Global installs live outside any project's node_modules.

Performs a clean, deterministic install straight from package-lock.json (or npm-shrinkwrap.json) intended for CI environments. It deletes any existing node_modules and refuses to run if package.json and the lockfile are out of sync.

Removes a package from node_modules and drops it from the matching section of package.json and the lockfile. Aliases: `remove`, `rm`, `r`, `un`.

Updates packages to the newest version that still satisfies the semver range in package.json and refreshes package-lock.json. Without arguments, it tries every listed dependency.

Executes a script from the `scripts` block of package.json in a shell where node_modules/.bin is on PATH. Alias: `run-script`; running `npm run` with no arg lists every available script.

Shortcut for `npm run start` — runs the `start` script from package.json. If no `start` script is defined, npm falls back to `node server.js`.

Shortcut for `npm run test` — runs the `test` script from package.json. Aliases: `npm t`, `npm tst`.

Runs a package's binary from a local install, the cache, or on-the-fly from the registry without a global install. `npx` is the shell-friendly shim; both are equivalent in npm 10+.

Uploads the current package to the registry so it can be installed by others. Honors the `files` field, `.npmignore`, and .gitignore to decide which files ship.

Removes a specific version — or the whole package — from the registry. Subject to strict rules: only within 72 hours of publish and only if nothing else depends on it.

Bumps the version field in package.json (and package-lock.json), then creates a git commit and tag — all in one step. Runs preversion/version/postversion lifecycle scripts.

Creates the tarball (`<name>-<version>.tgz`) exactly as `npm publish` would upload, without actually publishing. Perfect for previewing shipped files or for installing locally to test.

Prints the installed dependency tree of the current project (or globally). Aliases: `ls`, `la`, `ll`.

Compares installed versions against the registry and reports which packages have a newer version available in current/wanted/latest columns. `wanted` respects your semver range, `latest` is the newest published.

Fetches package metadata straight from the registry — versions, maintainers, dist-tags, dependencies, and more. Aliases: `info`, `show`, `v`.

Prints the dependency chain(s) that caused a specific package (or version) to be installed. Alias: `why`; invaluable for tracking down duplicate copies or unexpected transitive deps.

Creates a new package.json interactively, or when given an initializer (e.g. `npm init vite@latest`) delegates to `npm exec create-<initializer>`. `-y` accepts all defaults.

A set of flags — not a standalone command — that let npm operate against one, several, or every workspace declared in the root package.json's `workspaces` array. Introduced in npm 7 and refined through npm 10.

Submits the dependency tree to the registry's security advisory database and reports known vulnerabilities. Exits non-zero when problems at or above the audit level are found.

Automatically installs compatible updates that resolve reported vulnerabilities without breaking your declared semver ranges. `--force` will accept SemVer-major bumps.

Reads and writes npm configuration values across user, project (.npmrc), and global levels. Alias: `c`; `npm config list -l` shows every effective setting including defaults.