npm command reference, package.json fields and version semantics, and a dependency-hygiene workflow.
| Category | Command | Description |
|---|---|---|
| Install | npm install | Installs every dependency listed in package.json. |
| Install | npm install package-name | Installs a package and adds it to dependencies. |
| Install | npm install -D package-name | Installs as a devDependency — not shipped in a production install. |
| Install | npm ci | Clean install strictly from package-lock.json — faster and reproducible, the standard choice for CI. |
| Remove | npm uninstall package-name | Removes a package and its entry from package.json. |
| Update | npm outdated | Lists installed packages with newer versions available. |
| Update | npm update | Updates packages within the ranges allowed by package.json. |
| Security | npm audit | Scans installed dependencies for known vulnerabilities. |
| Security | npm audit fix | Attempts to automatically upgrade vulnerable dependencies to a patched version. |
| Scripts | npm run script-name | Runs a named script defined in package.json's "scripts" field. |
| Run | npx package-name | Runs a package's binary without a permanent global install. |
| Global | npm install -g package-name | Installs a package globally, making its CLI available system-wide. |
| Publish | npm publish | Publishes the current package to the npm registry. |
| Versioning | npm version patch | Bumps the patch version in package.json and creates a matching git tag. |
package.json Fields
| Field | Purpose |
|---|---|
"main" | The entry file loaded when the package is required/imported. |
"type": "module" | Treats .js files as ES modules (import/export) instead of CommonJS (require). |
"scripts" | Named shell commands runnable via npm run — build, test, dev, lint, etc. |
"dependencies" | Packages required at runtime — installed in a production install. |
"devDependencies" | Packages only needed for development/build/test — skipped by npm ci --omit=dev. |
"engines" | Declares which Node.js version(s) the package supports. |
Version Semantics
^1.2.3
~1.2.3
1.2.3
package-lock.json
Always commit package-lock.json
Guarantees every install (local, CI, teammate) resolves to the exact same dependency tree — without it, a "^" range can silently pull a different minor version on different machines.
Use npm ci in CI/CD, not npm install
npm ci refuses to run if package.json and the lockfile disagree, and is faster since it skips dependency resolution — install for local dev, ci for anything automated.
Run npm audit on a schedule
New vulnerabilities are disclosed against already-installed packages constantly — a periodic audit catches these even if dependencies themselves haven't changed.
Update deliberately, not reflexively
npm outdated first, then update in small batches with tests run after each — a mass "update everything" is much harder to bisect when something breaks.
Quick Tips
npx create-vite@latest always fetches the latest version — avoids the "my global CLI is out of date" class of bugs entirely.