What is npm?
npm combines a package website, registry and command-line interface for JavaScript development. The CLI installs project dependencies and supports package workflows. This profile separates the local tool and public packages from paid private-package account arrangements, with an offline npm ci reproduction using fictional local archives.
Who is npm for?
Developers and delivery teams managing JavaScript dependencies who need to distinguish local installations, lockfiles and registry account requirements.
The tool, the registry and the account are different layers
The npm overview distinguishes the website, CLI and registry. The command-line tool works with project dependencies, while hosted private-package access introduces its own account arrangements. Node.js supplies the JavaScript runtime.
For a delivery workflow, inspect the manifest, lockfile and installation options together. We tested the clean-install boundary in a disposable project containing two fictional local packages. No registry account, external package or production application was used.
npm features
The core capabilities to consider for your workflow.
- Project dependency installation and lockfiles
- Development-dependency installation controls
- Package and registry workflows
What does npm ci actually preserve?
Our reproduction used npm 11.6.2, Node.js v24.19.0 and Python 3.9.6 on 17 October 2026. Node.js 24 was an LTS branch in the support table we checked. These observations describe the supplied fixture, not a production application compatibility test.
We packed our own inert sr-demo-runtime and sr-demo-tool archives. The root manifest put the runtime in dependencies and the tool in devDependencies. Every npm command used offline mode, disabled installation scripts, audit and funding requests, and isolated configuration and cache paths.
1. Aligned files: a clean installation
With both packages locked at version 1.0.0, npm ci succeeded. Both were installed, and a stale marker inside the previous node_modules directory disappeared. The bytes of package.json and package-lock.json were unchanged. The root postinstall marker was absent because install scripts were disabled.
2. Omit development packages: the lock still records them
npm ci --omit=dev installed runtime 1.0.0 and left the development tool off disk. The tool’s locked version remained 1.0.0, and neither manifest file changed. An omitted installation did not mean that the dependency had been deleted from the project’s lockfile.
3. Changed manifest: the clean install refused the mismatch
We changed the tool request to a local version 2.0.0 archive while retaining the original lockfile. npm ci returned exit code 1 with EUSAGE. The changed manifest and old lockfile were both preserved. The npm ci documentation describes this requirement for the files to agree.
Resolve the intended change before retrying
In this fictional project, we deliberately ran npm install --package-lock-only. That updated the tool’s locked version to 2.0.0. A subsequent npm ci --omit=dev succeeded, still installed only the runtime and preserved the newly reconciled lockfile.
The install documentation explains lockfile reconciliation. In a real project, review the intended dependency and resulting lockfile diff. Deleting a lockfile is not the same operation as checking or reconciling it.
npm pricing
Free CLI; private registry services separate
The local CLI reproduction requires no paid npm account. Confirm current private-package and organisation terms separately if those features are needed; no paid registry price is assumed here.
Calculate the cost of your quote →Free access & evaluation
The npm CLI is open-source software under the Artistic License 2.0. Public-package sharing is free; private-package account arrangements are separate.
Before you choose npm
The CLI, hosted registry and private-package account features have separate scopes.
A matching lockfile does not prove that dependencies are secure or that the application will build.
Installation options, npm versions and project configuration can affect dependency outcomes.
Reproduce the installation boundary
Download the Python reproduction ↓
Download the observed JSON results ↓
Run python3 npm-ci-demo.py with Python 3, Node.js and npm installed. The script was tested on macOS with the recorded versions. It creates its own temporary packages, archives, project, empty npm configuration files and cache, then removes them on exit. It accepts no project path, uses offline mode and performs no global installation or package publication.
This small fixture tests dependency installation, not application builds, vulnerability findings, registry availability, private-package authentication, peer-dependency interactions or native-module compilation. The --no-audit flag means these results contain no audit assessment. An install success is not evidence that an application is secure or production-ready.
Explore related software
npm FAQs
Does npm ci update package-lock.json?
In our npm 11.6.2 reproduction, npm ci preserved package.json and package-lock.json when they matched. When the manifest requested a different local package version, it exited with EUSAGE and left both files unchanged. We reconciled the fictional lockfile with npm install --package-lock-only before repeating the clean install.
Does npm ci delete existing node_modules?
npm ci replaces the existing node_modules installation. In our test, a stale marker placed inside that directory disappeared and the aligned runtime and development packages were installed. Keep files you need to retain outside the dependency installation directory.
Why are devDependencies still in package-lock.json after npm ci --omit=dev?
Omitting development dependencies controls the installation on disk. In our test, the development tool was absent from node_modules but its version remained in package-lock.json; npm ci did not rewrite that lockfile.
Why does npm ci report EUSAGE for a package.json and package-lock.json mismatch?
npm ci expects the manifest and lockfile to agree. Our fixture changed a local development-tool request from version 1.0.0 to 2.0.0 while keeping the old lockfile; npm ci returned EUSAGE. Review the intended dependency change and regenerate and review the lockfile deliberately rather than expecting ci to update it.
Does --ignore-scripts skip postinstall during npm ci?
In our reproduction, npm ci used --ignore-scripts and the root postinstall marker was not created. That observation covers the install lifecycle in this fixture; it does not mean an explicit npm run command cannot run a script.
Is npm the same as Node.js?
No. Node.js is the JavaScript runtime. npm provides a package-management CLI and hosted website and registry services. Our local npm installation test used Node.js, without a registry login or paid account.