npm Cheatsheet

npm install resolves and may update package-lock.json based on the ranges in package.json, and will create node_modules if missing. npm ci deletes node_modules first and installs strictly from the existing package-lock.json without modifying it — it's faster and more reproducible, which is why it's the recommended command for CI/CD pipelines.

npx runs a package's binary without a permanent global install, downloading and caching it temporarily if needed — ideal for one-off scaffolding tools (like create-vite) you won't run daily. npm install -g is better for tools you use constantly across many projects (like a linter CLI) where you don't want the overhead of re-downloading each time.

It cross-references your installed dependency tree against the npm public vulnerability database and reports known security issues by severity, along with whether a fix is available via npm audit fix (which attempts to bump affected packages to a patched version within your existing semver ranges).

Workspaces let a single repository manage multiple packages (a monorepo). Commands like npm install --workspaces install dependencies for every workspace package at once, and npm run <script> -w <name> runs a script scoped to just one specific workspace package rather than the whole repo.

This reference is npm-specific, since npm ships with Node.js by default and its command syntax differs meaningfully from yarn and pnpm (different flags, different lockfile commands) — mixing them in one reference would risk giving you the wrong flag for your actual package manager.