npm-cli

Skill: npm-cli

When to Use

• When needing documentation or usage instructions for specific npm commands (e.g., npm install, npm exec, npm ci).
• When dealing with npm configuration files like .npmrc, package.json, or package-lock.json.
• When understanding npm concepts such as workspaces, scopes, and dependency selectors.

When Not to Use

• When managing alternative package managers like yarn or pnpm.
• When writing general JavaScript/TypeScript code that does not interact with npm packages or scripts.

Common Pitfalls

• Lockfile drift: Running npm install instead of npm ci in CI environments can produce different dependency trees than committed in package-lock.json. Always use npm ci in CI for reproducible installs.
• Registry auth leakage: Storing authentication tokens in .npmrc files that are committed to the repository can expose credentials. Use npm token with environment variables or .npmrc entries scoped per-registry.
• Unsafe lifecycle scripts: postinstall and preinstall scripts in dependencies execute arbitrary code. Use npm install --ignore-scripts when installing untrusted packages, then selectively run scripts for trusted dependencies.
• Missing engine checks: Relying on engines field in package.json without also setting engine-strict=true in .npmrc means npm will only warn (not fail) on version mismatches.

References

The following pages are mapped from the official npm CLI documentation (v11.15.0), with a small set of troubleshooting links sourced from the npm documentation repo (which tracks main). Use an available web fetching tool to read the raw markdown contents for deep insights into each command and concept. To fully utilize this skill, you MUST read at least one of the links relevant to the current context:

CLI Commands

• npm: JavaScript package manager
• npm access: Set access level on published packages
• npm adduser: Add a registry user account
• npm audit: Run a security audit
• npm bugs: Report bugs for a package in a web browser
• npm cache: Manipulates the package cache
• npm ci: Clean install a project
• npm completion: Tab Completion for npm
• npm config: Manage the npm configuration files
• npm dedupe: Reduce duplication in the package tree
• npm deprecate: Deprecate a version of a package
• npm diff: The registry diff command
• npm dist-tag: Modify package distribution tags
• npm docs: Open documentation for a package in a web browser
• npm doctor: Check the health of your npm environment
• npm edit: Edit an installed package
• npm exec: Run a command from a local or remote npm package
• npm explain: Explain installed packages
• npm explore: Browse an installed package
• npm find-dupes: Find duplication in the package tree
• npm fund: Retrieve funding information
• npm get: Get a value from the npm configuration
• npm help: Get help on npm
• npm help-search: Search npm help documentation
• npm init: Create a package.json file
• npm install: Install a package
• npm install-ci-test: Install a project with a clean slate and run tests
• npm install-test: Install package(s) and run tests
• npm link: Symlink a package folder
• npm ll: List installed packages
• npm login: Login to a registry user account
• npm logout: Log out of the registry
• npm ls: List installed packages
• npm org: Manage orgs
• npm outdated: Check for outdated packages
• npm owner: Manage package owners
• npm pack: Create a tarball from a package
• npm ping: Ping npm registry
• npm pkg: Manages your package.json
• npm prefix: Display prefix
• npm profile: Change settings on your registry profile
• npm prune: Remove extraneous packages
• npm publish: Publish a package
• npm query: Dependency selector query
• npm rebuild: Rebuild a package
• npm repo: Open package repository page in the browser
• npm restart: Restart a package
• npm root: Display npm root
• npm run: Run arbitrary package scripts
• npm sbom: Generate a Software Bill of Materials (SBOM)
• npm search: Search for packages
• npm set: Set a value in the npm configuration
• npm shrinkwrap: Lock down dependency versions for publication
• npm stage: Stage packages for publishing
• npm star: Mark your favorite packages
• npm stars: View packages marked as favorites
• npm start: Start a package
• npm stop: Stop a package
• npm team: Manage organization teams and team memberships
• npm test: Test a package
• npm token: Manage your authentication tokens
• npm trust: Manage trusted publishing relationships between packages and CI/CD providers
• npm undeprecate: Undeprecate a version of a package
• npm uninstall: Remove a package
• npm unpublish: Remove a package from the registry
• npm unstar: Remove an item from your favorite packages
• npm update: Update packages
• npm version: Bump a package version
• npm view: View registry info
• npm whoami: Display npm username
• npx: Run a command from a local or remote npm package

Configuring npm

• Install: Download and install node and npm
• Folders: Folder structures used by npm
• .npmrc: The npm config files
• npm-shrinkwrap.json: A publishable lockfile
• package.json: Specifics of npm's package.json handling
• package-lock.json: A manifestation of the manifest

Using npm

• Registry: The JavaScript Package Registry
• Package spec: Package name specifier
• Config: About npm configuration
• Logging: Why, What & How we Log
• Scope: Scoped packages
• Scripts: How npm handles the "scripts" field
• Workspaces: Working with workspaces
• Organizations: Working with teams & organizations
• Dependency Selectors: Dependency Selector Syntax & Querying
• Developers: Developer guide
• Removal: Cleaning the slate

Troubleshooting

• Common Errors: common-errors.mdx
• Generating and Locating npm Debug Log Files: generating-and-locating-npm-debug.log-files.mdx
• Try the Latest Stable Version of Node: try-the-latest-stable-version-of-node.mdx
• Try the Latest Stable Version of npm: try-the-latest-stable-version-of-npm.mdx