npm Cheatsheet - Node.js Package Manager Reference

A Node project is only as reproducible as your dependency commands. This reference runs the whole lifecycle: init/scaffold, install/update/remove, version ranges and package-lock, npm scripts and npx, npm ls/audit/outdated for health, publishing, and config/cache handles. Compare to a bare command list, it also flags lockfile and audit subtleties that bite teams. Use it when CI fails on dependency resolution or a package won't install at the expected version. After reading you operate dependencies and debug install issues with intent.

Languages·41 commands·Last updated 2026-07-21

Project Init 4

npm init -y

Quick package.json (defaults)

npm init

Interactive package.json

npm init <initializer> [args]

Scaffold a project (e.g. npm init vite)

npm create <initializer>@latest

create is an alias of init, like npx create-<init>

Install & Uninstall 7

npm install

Install all deps from package.json

npm install <pkg>

Install into dependencies

npm install -D <pkg>

Install into devDependencies

npm install -g <pkg>

Install globally

npm install <pkg> --save-exact

Pin exact version (-E)

npm uninstall <pkg>

Uninstall a dependency

npm uninstall -g <pkg>

Uninstall a global package

Version Management 6

npm install <pkg>@1.2.3

Install a specific version

npm install <pkg>@latest

Install/update to latest

npm install <pkg>@^1.0.0

Install by semver range (^, minor upgrades)

npm update [pkg]

Update deps within semver

npm outdated

List outdated deps (current/wanted/latest)

npm dedupe

Dedupe the dependency tree

Scripts & Run 6

npm run <script>

Run a script

npm start

Run the start script

npm test

Run the test script

npm run

List all scripts

npx <command> [args]

Run a package without installing (npx)

npm run <script> -- --port 8080

Pass args after -- to the script

Dependency Inspection 6

npm ls

View the dependency tree

npm ls --depth=0

Top-level deps only

npm ls <pkg>

Check if a package is installed

npm why <pkg>

Why a dependency is present (npm 7+)

npm audit

Audit for vulnerabilities

npm audit fix

Auto-fix vulnerabilities

Publish & Release 5

npm version <patch|minor|major>

Bump version and git tag

npm publish

Publish to the registry

npm publish --tag beta

Publish under a dist-tag (e.g. beta)

npm deprecate <pkg>@<ver> "reason"

Deprecate a version

npm owner add <user> [<pkg>]

Add a package owner

Config & Cache 7

npm config get registry

Show the current registry

npm config set registry https://registry.npmmirror.com

Switch to the npmmirror registry

npm config set <key> <value>

Set a config key (.npmrc)

npm config list

List all config

npm cache clean --force

Clean the npm cache

npm cache verify

Verify and clean cache

npm ci

Clean install from lockfile (CI/CD)

Tips

npm install with no args installs all deps from package.json.
Commit package-lock.json to lock dependency versions.
npx runs a package without a global install, e.g. npx create-react-app my-app.
npm ci is faster and more reliable than npm install; needs a lockfile.
Set registry.npmmirror.com for a faster mirror in China.
audit fix --force may introduce breaking changes; be careful in production.

Official References

Each command links to its official documentation below, so you can verify the latest usage and read deeper.

Node.js Docs

Maintained by LaoHand

Publicly updated on Jul 21, 2026, continuously proofread against official docs.

Contact Us

Wrong command or description? Send us corrections, business inquiries or product feedback by email.