iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a project, npm install reads package.json and, if present, package-lock.json, resolves a dependency tree, and installs packages in node_modules. It may also update the lockfile, and package lifecycle scripts may execute during installation. The exact result depends on the project files, npm version and configuration, platform, and scripts defined by the project and its dependencies.
What npm install does, step by step
- Reads the project files. The dependency entries in
package.jsonspecify acceptable version ranges. When a lockfile exists and its resolved versions satisfy those ranges, npm uses those versions; if they do not, npm can resolve versions that satisfy the manifest and update the lockfile. npm’s install documentation explains this reconciliation. - Resolves the dependency tree. npm accounts for dependencies’ own dependencies and peer-dependency rules, with behavior affected by configuration. The documented default install strategy is
hoisted; npm also supportsnested,shallow, andlinkedstrategies. The strategy determines how packages are laid out on disk. - Installs packages in
node_modules. npm materializes the resolved tree using the selected strategy. The lockfile records resolved dependency information so the tree can be reviewed and subsequent installs can use it. npm’s package-lock documentation describes its role. - May run lifecycle scripts. Scripts defined by the project or its dependencies can run as part of installation, so an install can execute commands, not just copy files. What those commands do varies by package. npm documents
ignore-scriptsas disabling scripts specified in package.json files; consult the npm scripts documentation and the project’s configuration when you need to understand a particular install.
Native builds are conditional
A native build is not an inevitable part of every install. npm documents a specific case: if the root package has a binding.gyp file and does not define a custom install or preinstall script, npm defaults to building with node-gyp. The lifecycle-script documentation gives the conditions.
Does npm install change package-lock.json?
It can. The manifest’s version ranges define what versions are acceptable; the lockfile records the resolved dependency information. If the lockfile’s versions fit the manifest, npm uses them. If they do not, npm install can resolve a compatible tree and write the change to package-lock.json. That is why a lockfile change after installation is worth reviewing rather than automatically discarding.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA lockfile helps preserve and review a dependency tree, but it does not make every installation identical in every practical respect. Configuration flags, npm versions, platform filtering, and lifecycle scripts can affect what happens. The lockfile’s purpose includes avoiding repeated metadata resolution, but that does not mean every install avoids network activity.
#1 Best Overall
How npm install differs from npm ci
Use npm install when npm should reconcile the project manifest and lockfile. Use npm ci for a clean, lockfile-enforcing installation of a whole project, such as in automation.
| Behavior | npm install |
npm ci |
|---|---|---|
| Lockfile | Can resolve again and update the lockfile when its versions do not satisfy the manifest. | Requires an existing lockfile, fails if the manifest and lockfile do not match, and does not write to either package.json or the lockfile. |
Existing node_modules |
Does not have the documented clean-install requirement to remove it. | Removes the existing directory before installing. |
| Best suited to | Reconciling project dependencies during development or maintenance. | A clean install where the committed lockfile is expected to define the dependency tree. |
| Tree-shaping flags | Can use configuration that affects the dependency tree. | If the lockfile was created with tree-shaping flags, npm warns that the same flags are needed for npm ci to avoid errors. |
These behaviors are documented in npm’s npm ci command reference and npm install command reference. A lockfile mismatch is therefore handled differently: npm install can reconcile it, while npm ci stops rather than rewriting it.
What to check after running it
- Review any
package-lock.jsonchanges to see whether npm resolved a different dependency tree. - Check the project’s lifecycle scripts and relevant configuration if you need to know what commands could run during installation.
- For automated clean installs, confirm that the lockfile is committed and consistent with
package.json; if tree-shaping flags were used to create it, configurenpm ciwith those same flags.
The npm CLI documentation cited here is labeled version 12.1.0 on the install page. Exact resolver operations, network requests, cache hits, and timing are not a universal fixed sequence; they depend on the environment and project.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Rank #4
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
