npm, yarn, pnpm essential commands
Install, add a dependency, run a script: the same gesture across the three most common JavaScript package managers.
Installing dependencies
| npm | yarn | pnpm | Effect |
|---|---|---|---|
npm install |
yarn |
pnpm install |
Install everything in package.json |
npm install pkg |
yarn add pkg |
pnpm add pkg |
Add a dependency |
npm install -D pkg |
yarn add -D pkg |
pnpm add -D pkg |
Add a dev dependency |
npm install -g pkg |
yarn global add pkg |
pnpm add -g pkg |
Install globally |
npm uninstall pkg |
yarn remove pkg |
pnpm remove pkg |
Remove a dependency |
Scripts and execution
npm run dev # run the "dev" script from package.json npm start # shorthand for the "start" script npx eslint . # run a binary without installing it globally
Versions and audit
npm outdated # dependencies with a newer version available npm update # update within semver constraints npm audit # known vulnerabilities npm audit fix # auto-fix what's safe to fix npm ci # strict install from the lockfile (CI/prod)
npm ci (instead of npm install) is built for CI and prod: it removes node_modules and reinstalls strictly what the lockfile says, never modifying it — faster and 100% reproducible.
Lockfiles
| Tool | File |
|---|---|
| npm | package-lock.json |
| yarn | yarn.lock |
| pnpm | pnpm-lock.yaml |
Never mix two package managers on the same project: two up-to-date lockfiles guarantee inconsistencies.
package.json: essential fields
{ "name": "my-project", "version": "1.2.0", "scripts": { "dev": "vite", "build": "vite build", "test": "vitest" }, "dependencies": { "vue": "^3.4.0" }, "devDependencies": { "vite": "^5.0.0" } }
dependencies = needed in production; devDependencies = only for developing/building (tests, bundler…), never shipped to prod.
Thanks for the feedback!