npm / pnpm / yarn Cheat Sheet
The three JavaScript package managers side by side. Yarn commands are for Yarn 2+ (Berry) unless marked v1. Enable pnpm/yarn with corepack enable.
On this page
Side by Side #
| Task | npm | pnpm | yarn |
|---|---|---|---|
| New project | |||
| Install all deps | |||
| Add a package | |||
| Add a dev dependency | |||
| Add a specific version | |||
| Install globally | (v1) | ||
| Remove | |||
| Run a script | |||
| Run a package once | |||
| Update deps | |||
| Update to latest (ignore ranges) | |||
| Show outdated | |||
| CI install (lockfile only) | |||
| Why is this installed? | |||
| List installed | |||
| Security audit | |||
| Publish | |||
| Lockfile | package-lock.json | pnpm-lock.yaml | yarn.lock |
npm Extras #
| Command | Action |
|---|---|
| List available scripts | |
| / | Log in to the npm registry |
/ minor / major | Bump the version + git tag |
Publish a scoped package (@you/pkg) publicly | |
| See which files would be published | |
| Use a local package in another project | |
| Clear the cache | |
| Show the registry | |
| All published versions | |
| Scaffold a project with a template |
Version Ranges in package.json #
| Range | Allows |
|---|---|
"1.2.3" | Exactly 1.2.3 |
"^1.2.3" | 1.x.x (≥1.2.3, <2.0.0), the default |
"~1.2.3" | 1.2.x (≥1.2.3, <1.3.0) |
"*" / "latest" | Anything (avoid) |
Workspaces (monorepo) #
| Task | npm | pnpm | yarn |
|---|---|---|---|
| Define | "workspaces": ["packages/*"] in package.json | pnpm-workspace.yaml | "workspaces" in package.json |
| Run in one package | |||
| Run in all |
Node Versions #
| Command | Action |
|---|---|
| / | Versions |
| / | nvm (macOS/Linux; nvm-windows is similar) |
| / | fnm (fast, cross-platform) |
"engines": { "node": ">=20" } | Declare the Node version in package.json |
Fix Weird Install Problems #
rm -rf node_modules package-lock.json # or pnpm-lock.yaml / yarn.lock
npm cache clean --force
npm installTips #
- Commit the lockfile. Never commit
node_modules. npm runscripts can call binaries innode_modules/.bindirectly ("lint": "eslint .").pnpmsaves a lot of disk space by sharing one package store between projects.
npm initalso: npm createCreate a package.json or scaffold a project. npm init [initializer] [options]
| Usage / option | What it does |
|---|---|
npm init | Questions → package.json |
-y | Use defaults, no questions |
npm init vite@latest | Run create-vite (same as npm create vite@latest) |
npm create astro@latest | Any create-* package |
-w packages/a | Create a workspace |
--scope=@milanlaukens | Scoped package name |
pnpmFast, disk-efficient package manager. pnpm command [options]
| Command / option | What it does |
|---|---|
install (i) | Install everything (--frozen-lockfile in CI) |
add pkg | Add (-D dev, -g global, -E exact, -O optional) |
remove pkg (rm) | Remove |
update (up) | Update within ranges (--latest / -L = newest, -i interactive) |
dev / run dev | Run a script (run is optional) |
dlx pkg | Run a package once (like npx) |
exec cmd | Run a binary from node_modules/.bin |
outdated / audit | Outdated / vulnerable packages |
why pkg | Why it is installed |
list (ls) | Installed packages (--depth 1) |
-r | Recursive: every workspace package |
--filter pkg (-F) | Only some workspace packages (--filter ./apps/*) |
store prune | Clean the global store |
init | New package.json |
publish | Publish (--access public, --no-git-checks) |
yarnYarn package manager (commands for Yarn 2+ / Berry; v1 = classic). yarn command [options]
| Command / option | What it does |
|---|---|
yarn / install | Install everything (--immutable in CI; v1: --frozen-lockfile) |
add pkg | Add (-D dev, -E exact, -P peer) |
remove pkg | Remove |
up pkg | Upgrade (up pkg@latest; v1: upgrade) |
upgrade-interactive | Pick upgrades from a list |
dev / run dev | Run a script |
dlx pkg | Run a package once (like npx) |
why pkg | Why it is installed |
info pkg | Package details |
workspace name cmd | Run in one workspace |
workspaces foreach -A run build | Run in every workspace |
npm audit / npm publish | Audit / publish (Berry) |
set version stable | Update Yarn for this project |
global add pkg | v1 only: global install (Berry: use dlx) |
npm installalso: npm i npm addInstall dependencies. npm install [packages] [options]
| Option | What it does |
|---|---|
| (no packages) | Install everything from package.json |
pkg | Add a dependency (saved in package.json) |
pkg@1.2.3 / pkg@latest / pkg@next | Specific version or tag |
-D (--save-dev) | Development dependency |
-g | Install a CLI globally |
-E (--save-exact) | Save 1.2.3 instead of ^1.2.3 |
-O (--save-optional) | Optional dependency |
--no-save | Install without changing package.json |
--omit=dev | Skip dev dependencies (production) |
--legacy-peer-deps | Ignore peer-dependency conflicts |
-f (--force) | Force (overrides conflicts and cache) |
--ignore-scripts | Don't run install scripts |
--no-audit --no-fund | Quieter, faster |
../my-lib / user/repo / file.tgz | Install from a folder, GitHub or a tarball |
npm uninstallalso: npm rmRemove a dependency. npm uninstall pkg [options]
| Option | What it does |
|---|---|
pkg | Remove and update package.json |
-g | Remove a global package |
-D | Remove from devDependencies |
--no-save | Don't change package.json |
npm runalso: npm run-scriptRun a script from package.json. npm run name [-- args]
| Usage / option | What it does |
|---|---|
npm run | List all scripts |
npm run dev | Run the "dev" script |
npm run test -- --watch | Pass arguments to the script after -- |
-w pkg / --workspaces | In one / every workspace |
--if-present | No error if the script doesn't exist |
-s | Silent: hide npm's own output |
npm start / npm test | Shortcuts without run |
npxalso: npm execRun a package's command without installing it globally. npx [options] command [args]
| Option | What it does |
|---|---|
npx eslint . | Run a binary from node_modules/.bin (or download it) |
npx create-vite@latest | Run a specific version |
-y | Don't ask before downloading |
-p pkg -c "cmd" | Install pkg and run a shell command with it |
--no-install | Fail instead of downloading |
npm updateUpdate packages within the allowed ranges. npm update [packages] [options]
| Option | What it does |
|---|---|
| (none) | Update everything allowed by ^ / ~ |
pkg | One package |
-g | Global packages |
--save | Also write new versions into package.json |
Jump to new major versions with npm install pkg@latest.
npm outdatedWhich packages have newer versions. npm outdated [packages] [options]
| Option | What it does |
|---|---|
| (none) | Current, wanted (allowed by range) and latest versions |
-g | Global packages |
--long | Also show the dependency type |
--json | JSON output |
npm ciClean install exactly from the lockfile (CI, Docker). npm ci [options]
| Option | What it does |
|---|---|
| (none) | Deletes node_modules and installs package-lock.json exactly; fails if it doesn't match package.json |
--omit=dev | Production only |
--ignore-scripts | Don't run install scripts |
--prefer-offline | Use the cache when possible |
npm explainalso: npm whyWhy is a package installed? npm explain pkg
| Usage | What it does |
|---|---|
npm explain lodash | The dependency chain(s) that pulled it in |
--json | JSON output |
npm lsalso: npm listInstalled packages as a tree. npm ls [packages] [options]
| Option | What it does |
|---|---|
| (none) | Top-level dependencies |
--all | Full tree |
--depth 1 | Limit the depth |
pkg | Where a package appears in the tree |
-g --depth 0 | Global packages |
--omit=dev | Production dependencies only |
--json / --parseable | Machine-readable output |
npm auditCheck for known vulnerabilities. npm audit [fix] [options]
| Option | What it does |
|---|---|
| (none) | Report |
fix | Upgrade to safe versions within ranges |
fix --force | ⚠ Also breaking (major) upgrades |
--omit=dev | Production dependencies only |
--audit-level=high | Only fail on high/critical (CI) |
--json | JSON report |
npm publishPublish a package to the registry. npm publish [folder] [options]
| Option | What it does |
|---|---|
--access public | Required for the first publish of a scoped package (@you/pkg) |
--tag next | Publish under a dist-tag instead of latest |
--dry-run | Show what would be published |
--otp 123456 | Two-factor code |
--provenance | Signed provenance from CI (GitHub Actions) |
-w pkg | Publish a workspace |
npm loginalso: npm adduserLog in to the npm registry. npm login [options]
| Option | What it does |
|---|---|
| (none) | Log in (opens the browser) |
--registry URL | Another registry |
--scope @org | Associate a scope with the registry |
npm whoami | Check who is logged in |
npm logout | Log out |
npmNode package manager. npm command [options] (the sub-commands have their own entries)
| Option | What it does |
|---|---|
-v | npm version (node -v for Node) |
help install | Help for a command (npm install -h for a short version) |
-g | Global: for the whole computer, not the project |
-w pkg / -ws | Run in one / all workspaces |
--prefix folder | Run as if in another folder |
--registry URL | Use another registry |
-y | Accept defaults / don't ask |
--loglevel silent | Less output (--silent, -s) |
doctor | Check your npm setup |
whoami | Logged-in user |
npm versionBump the version, commit and tag. npm version [level] [options]
| Option | What it does |
|---|---|
patch / minor / major | 1.2.3 → 1.2.4 / 1.3.0 / 2.0.0 |
prerelease --preid=beta | 1.2.4-beta.0 |
1.5.0 | Set an exact version |
-m "Release %s" | Commit message (%s = version) |
--no-git-tag-version | Change package.json only, no commit/tag |
| (no level) | Show versions of npm, Node and the package |
npm packCreate the .tgz that publish would upload. npm pack [options]
| Option | What it does |
|---|---|
| (none) | Write name-version.tgz |
--dry-run | Only list the files that would be included |
--pack-destination dist/ | Where to save it |
--json | JSON output |
npm linkUse a local package in another project while developing. npm link [folder|pkg]
| Usage | What it does |
|---|---|
npm link (in the library) | Make it available globally |
npm link my-lib (in the app) | Use the linked library |
npm link ../my-lib | Both steps at once |
npm unlink my-lib | Undo (then npm install) |
npm cacheManage npm's download cache. npm cache command
| Command | What it does |
|---|---|
verify | Check and clean the cache |
clean --force | Delete the whole cache |
ls | List cached packages |
npm confignpm settings (.npmrc). npm config command [key] [value]
| Command / option | What it does |
|---|---|
list | Show settings (-l = all defaults too) |
get registry | Read one setting |
set init-author-name "Milan" | Change a setting |
delete key | Remove a setting |
edit | Open .npmrc in your editor |
--location project | Project .npmrc instead of your user one |
get prefix | Where global packages are installed |
npm viewalso: npm infoRegistry information about a package. npm view pkg [field]
| Usage | What it does |
|---|---|
npm view react | Summary |
npm view react version | Latest version |
npm view react versions | All versions |
npm view react dist-tags | latest, next, beta… |
npm view react dependencies | Dependencies |
--json | JSON output |
nodeRun JavaScript. node [options] [file] [args]
| Option | What it does |
|---|---|
-v | Node version |
node app.js | Run a file |
node | Interactive REPL (.exit to leave) |
-e "code" | Evaluate code |
-p "1 + 2" | Evaluate and print the result |
--watch app.js | Restart when files change (Node 18.11+) |
--env-file=.env | Load environment variables (Node 20.6+) |
--run dev | Run a package.json script (Node 22+) |
--test | Run the built-in test runner |
--inspect / --inspect-brk | Debugger (Chrome chrome://inspect, VS Code) |
-r dotenv/config / --import x | Load a module first (CommonJS / ESM) |
-c file.js | Check syntax without running |
--max-old-space-size=4096 | More memory (MB) |
--experimental-strip-types | Run .ts files directly (on by default from Node 23.6) |
nvmNode Version Manager (macOS/Linux; nvm-windows uses similar commands). nvm command
| Command | What it does |
|---|---|
install --lts | Install the newest LTS (install 22, install node = latest) |
use 22 | Switch this shell to Node 22 (nvm use reads .nvmrc) |
ls | Installed versions (nvm-windows: nvm list) |
ls-remote --lts | Available versions (nvm-windows: nvm list available) |
alias default 22 | Default for new shells |
current | Version in use |
uninstall 18 | Remove a version |
exec 20 node app.js | Run once with another version |
fnmFast Node Manager (Windows, macOS, Linux). fnm command
| Command / option | What it does |
|---|---|
install 22 | Install (--lts = newest LTS) |
use 22 | Switch version (reads .nvmrc / .node-version without argument) |
default 22 | Default version |
list / list-remote | Installed / available versions |
current | Version in use |
uninstall 18 | Remove |
env --use-on-cd | Shell setup: switch automatically when changing folders |
Nothing on this sheet matches “”.