Applies to: npm 11 with Node.js 24 LTS (tested with npm 11.17 and Node.js 24.19 on AlmaLinux 9)
npm is the package manager that comes with Node.js. These are the commands you use every day, with what they printed in our tests.
Start a project
npm init -y # create package.json with defaults
Install packages
npm install express # add a dependency (short: npm i express) npm install --save-dev nodemon # a development-only dependency (-D) npm install # install everything listed in package.json npm install -g pm2 # a global command-line tool
As root, global packages go under /usr/local (npm prefix -g). For servers, prefer installing tools per project, or use npx.
npm ci for servers and deployments
npm ci
npm ci installs exactly the versions in package-lock.json, deleting node_modules first. It is faster and repeatable, so use it for deployments and CI. Without a lock file it stops with npm error code EUSAGE and: The `npm ci` command can only install with an existing package-lock.json or npm-shrinkwrap.json with lockfileVersion >= 1. Commit package-lock.json to your repository.
Check and update
npm outdated # what has newer versions npm update # update within the ranges in package.json npm install express@latest # move to a new major version on purpose npm ls --depth=0 # what is installed
In our test, npm outdated showed express at Current 4.22.3, Wanted 4.22.3 and Latest 5.2.1: npm update stays on version 4, because moving to 5 can break code.
Run scripts
npm run build # runs "scripts.build" from package.json npm start # "scripts.start" npm test # "scripts.test" npm pkg set scripts.hello="echo hi" # add a script from the command line
Security audit
npm audit # list known vulnerabilities npm audit fix # apply compatible fixes
A clean project reports found 0 vulnerabilities. Avoid npm audit fix --force on production code without testing: it may install new major versions.
Remove packages
npm uninstall nodemon npm uninstall -g pm2
Run a tool without installing it
npx --yes cowsay hi
Configuration and cache
npm config list npm config get registry npm cache verify
Installation problems: clear the npm cache. Installing Node.js: Node.js and npm on Linux. Node.js apps run well on a KVM VPS.
