npm

Walk through `package.json` creation interactively, prompting for name / version / description / entry point / etc.

-y accept all defaults; --init.author 'Name <e@x>' override defaults

Generate a `package.json` immediately with sensible defaults (`name` from directory, `version` 1.0.0, etc.) — the modern starting point.

Install every dependency listed in `package.json`, refreshing `node_modules` and `package-lock.json`. Skips dev deps if `NODE_ENV=production`.

--save-exact / -E pin exact versions; --legacy-peer-deps; --force; --no-audit; --prefer-offline

Clean install strictly from `package-lock.json`. Faster than `npm install`, deletes `node_modules` first, and refuses to mutate the lockfile — the right call for CI.

--omit=dev skip devDependencies; --prefer-offline

Add a runtime dependency (default `dependencies`). Records the resolved version in `package-lock.json` and writes `package.json`.

<pkg>@<version-range>; --save-dev / -D; --save-exact / -E; --save-optional / -O; --save-prod / -P

Install a specific version range (semver): exact `1.2.3`, tilde `~1.2.3`, caret `^1.2.3`, or tag like `latest` / `next` / `beta`.

Add to `devDependencies` — tools only needed at build / test time (TypeScript, Jest, ESLint, Prettier).

Install a package globally so its binary is on `PATH` for every project (TypeScript, tsx, create-react-app, http-server).

Remove a package from `node_modules` and `package.json`.

-D remove from devDependencies; -g remove a global; --save false to skip manifest edit (rare)

Upgrade every dependency within the range allowed by `package.json` semver specs, refreshing `package-lock.json` accordingly.

--save false to skip manifest write; --workspace update inside workspaces

Update one package to the latest version that satisfies its current semver range.

Upgrade a single package to the newest release (bypasses the semver range and rewrites the range to `^<new-version>`).

Execute a script defined under the `scripts` section of `package.json`. `npm test`, `npm start`, `npm stop`, `npm restart` are shorthand for `npm run X`.

-- silent suppress npm log noise; --if-present don't error if missing; -- <args> forward remaining args to the script

Pass extra CLI arguments to the underlying script. Everything after `--` is forwarded untouched.

Run a command from a local or `npx`-cached package. Replaces the deprecated `npx <command>` direct call.

Print the dependency tree of the current project (top-level + transitive). Useful for finding duplicate copies of a package.

--all; --depth=N limit depth; --json output JSON; -g list globals

Show a table of every dep whose installed version is older than the latest version allowed by the manifest's range.

--long verbose; --json output JSON

Display registry metadata for a package — versions, dist-tags, dependencies, maintainers, repository URL, readme excerpt.

versions; time; dist-tags; repository.url

Generate a standalone `npm-shrinkwrap.json` (same format as `package-lock.json`) for apps that need reproducible installs even when shipped without a lockfile.

Print the currently-active registry URL. Default is `https://registry.npmjs.org/`.

Point npm at a private / cached registry (GitHub Packages, Verdaccio, China mirrors). Write to `~/.npmrc` or project `.npmrc`.

Authenticate against the configured registry and store a token in `~/.npmrc`. Required before `npm publish`.

--registry=<url> log in to a different registry; --scope=<scope> restrict token

Upload the current package to the configured registry. Requires `name` (and usually `version`, `repository`) in `package.json` and a logged-in user with publish rights.

--access public|restricted (scoped packages); --dry-run; --tag <tag> ship under a dist-tag

Remove a specific version from the registry. **Strongly discouraged within 72 hours of publish** — npm supports it but discourages.

Mark a version as deprecated with a message that npm prints on install. The right way to point users at a fix without deleting history.

Run a security audit against the installed dependency tree, fetching advisories from the npm registry.

--json; --omit=dev skip dev deps; --audit-level=low|moderate|high|critical

Auto-upgrade packages to the closest non-breaking version that resolves the advisory. Use `npm audit fix --force` only when you accept semver-major jumps.

--force; --dry-run

Wipe the global npm cache (`~/.npm` on POSIX). Use after switching registries or chasing weird install errors.

Validate the integrity of cached tarballs without deleting. Safe to run any time.

Install a package into a single named workspace within a monorepo (defined under `workspaces` in `package.json`).

Run a script in every workspace of the monorepo. `-w <name>` runs only one workspace.

--if-present don't error if missing

Run environment diagnostics (Node version, registry reachability, cache health, Git presence) — handy when troubleshooting.

Print the funding links for the current project's direct dependencies (used by maintainers to sponsor OSS).

Mutate fields inside `package.json` from the CLI without opening an editor. Useful in scripts / hooks.