npm Cheat Sheet
npm, pnpm, and Yarn package workflows: install, scripts, semver, lockfiles, configuration, publishing, and npx.
Package managers resolve dependencies, run project scripts, and publish JavaScript packages. Keep one lockfile authoritative for a project, review dependency changes, and use the same manager in local and automated environments.
Install, update, and remove
The three managers use different executable names but share familiar package concepts. npm is bundled with Node.js; pnpm uses a content-addressable store; Yarn offers its own install and workspace workflows.
npm install express
pnpm add express
yarn add express
npm install
pnpm install
yarn install
npm update express
pnpm update express
yarn up express
npm uninstall express
pnpm remove express
yarn remove express
| Task | npm | pnpm | Yarn |
|---|---|---|---|
| Add runtime dependency | npm install pkg | pnpm add pkg | yarn add pkg |
| Add development dependency | npm install -D pkg | pnpm add -D pkg | yarn add -D pkg |
| Install exact lockfile state | npm ci | pnpm install --frozen-lockfile | yarn install --immutable |
| Global install | npm install -g pkg | pnpm add -g pkg | yarn global add pkg |
| Force operation | --force | --force | --force |
Scripts and execution
Project scripts live in package.json. run is explicit with npm and pnpm; Yarn runs a named script directly. npx resolves and runs a package binary, while pnpm dlx and yarn dlx provide similar one-off execution.
npm run build
pnpm build
yarn build
npm run lint -- --fix
pnpm lint -- --fix
yarn lint --fix
npx create-vite my-app
pnpm dlx create-vite my-app
yarn dlx create-vite my-app
npm exec -- package args is the longer npm form. Prefer a local project binary over a global install so contributors and CI use the declared version.
Semver ranges
A dependency range describes which published versions may be selected. A lockfile records the concrete resolution, so a range can stay broad while repeatable installs remain precise.
| Range | Typical meaning for 1.4.2 | Matching intent |
|---|---|---|
1.4.2 | Exact release | Only 1.4.2 |
^1.4.2 | Compatible minor and patch updates | >=1.4.2 <2.0.0 |
^0.4.2 | Compatible patch updates before 0.5.0 | >=0.4.2 <0.5.0 |
~1.4.2 | Patch updates | >=1.4.2 <1.5.0 |
* | Any available version | Broadest range; avoid for reproducibility |
>=1.4.2 <2 | Explicit interval | Custom lower and upper bounds |
npm install lodash@^4.17.0
pnpm add lodash@~4.17.0
yarn add lodash@4.17.0
npm view lodash versions --json
Lockfiles and dependency flags
Commit the lockfile generated by the chosen manager: package-lock.json, pnpm-lock.yaml, or yarn.lock. Use -D/--save-dev for tooling, -g/--global for machine-wide commands, and --force only when the normal safety checks are intentionally overridden.
npm install -D typescript
pnpm add --save-dev typescript
yarn add --dev typescript
npm ci
pnpm install --frozen-lockfile
yarn install --immutable
Avoid mixing managers in one project unless the repository documents why. Delete an obsolete lockfile only as a deliberate migration, then install with the new manager and review the complete diff.
Init and configuration
npm init creates a package manifest interactively; pnpm init and yarn init provide equivalent setup. Configuration may be project-local or user-level in .npmrc; registry, scope, cache, and authentication settings should not expose tokens in source control.
npm init -y
pnpm init
yarn init -2
npm config get registry
npm config set registry https://registry.npmjs.org/
pnpm config get store-dir
A project .npmrc can set options such as save-exact=true or a scoped registry. Keep credentials in the user configuration or CI secret store, not in a committed file.
Publish and inspect packages
Before publishing, inspect the packed contents and verify the package name, version, entry points, and files included by files or ignore rules. npm publish is the common registry command; pnpm and Yarn can publish through their compatible commands.
npm pack --dry-run
npm publish --access public
pnpm publish --access public
yarn npm publish --access public
npm view package-name version dist-tags
npm version patch
npm deprecate package-name@1.0.0 "Use the replacement package"
Publishing is version-based: a registry normally rejects reusing an existing name-and-version pair. Use npm publish --tag next for a prerelease channel and npm dist-tag add package-name@1.2.0 latest to adjust a tag.