Running npm install in a project makes npm read its dependency declarations and lockfile, resolve a dependency tree, and install packages into node_modules. It may also update package-lock.json, and project or package lifecycle scripts may execute. The exact changes depend on the project files, npm version, configuration, platform, and package scripts.
What npm reads before installing
In a project, package.json declares dependencies and the version ranges the project accepts. If a package-lock.json is present, npm uses it to guide the installation. When the locked versions satisfy the ranges in the manifest, npm uses those resolved versions. If they do not, npm install can resolve versions that satisfy the manifest and update the lockfile. See npm’s package.json documentation and npm install documentation.
As an Amazon Associate I earn from qualifying purchases.
How npm builds and installs the dependency tree
npm resolves a tree that meets the declared version constraints and peer-dependency rules, with behavior influenced by configuration. It then materializes that tree in node_modules. The documented default layout strategy is hoisted; npm also documents nested, shallow, and linked strategies. The chosen strategy affects where packages appear within the installed tree.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →The lockfile records the resolved tree and is meant to make dependency changes reviewable and subsequent installs more reproducible. It can help npm skip repeated metadata resolution, but that does not mean every install avoids network activity. The precise network requests, cache use, and timing are not a universal fixed sequence.
#1 Best Overall
Does npm install change package-lock.json?
It can. If the lockfile’s resolved versions still satisfy the dependency ranges in package.json, npm uses them. If the manifest and lockfile no longer agree, npm can resolve a compatible tree and write the resulting changes to package-lock.json. Review the lockfile diff along with any manifest changes before committing, since it captures the resolved dependency tree rather than replacing the manifest’s version constraints.
Does npm install run scripts?
It may. Packages can define lifecycle scripts that run as part of installation, and those commands can have effects beyond placing files in node_modules. Their specific behavior depends on the project and packages being installed. npm’s Scripts documentation describes lifecycle scripts; npm’s install documentation describes the ignore-scripts option for disabling scripts specified in package manifests.
Native compilation is conditional, not an automatic part of every install. npm documents that when the root package has a binding.gyp file and no custom install or preinstall script, npm defaults to building with node-gyp.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhen to use npm install or npm ci
Use npm install when you want npm to reconcile the manifest and lockfile, including resolving again and updating the lockfile when needed. Use npm ci for a clean, lockfile-enforcing install, commonly in automation. The differences matter when you need to preserve an existing install or ensure the checked-in lockfile is followed exactly.
Rank #3
| Behavior | npm install |
npm ci |
|---|---|---|
| Lockfile required | No; it can resolve from the manifest and create a lockfile. | Yes; it requires an existing lockfile. |
| Manifest and lockfile mismatch | Can resolve to satisfy the manifest and update the lockfile. | Fails rather than reconciling the mismatch. |
Existing node_modules |
Not documented as being removed by the command. | Removes the existing directory before installing. |
| Writes manifest or lockfile | May update package-lock.json when resolving changes. |
Does not write to package.json or the lockfile. |
| Typical purpose | Installing or reconciling dependencies during project work. | Reproducing a clean project install from a consistent lockfile. |
If the lockfile was created with tree-shaping flags, npm ci needs the same flags to avoid errors. Check npm’s npm ci documentation for the applicable behavior. The npm install documentation, currently labeled CLI version 12.1.0, puts the distinction this way: “If you want to install packages while ensuring that package.json is not modified and that both files are strictly in sync, use npm ci instead.”
Quick Recap
Rank #4
What to check after an install
- Review changes to
package.jsonandpackage-lock.jsonbefore committing. - Look for warnings or errors that indicate dependency conflicts, failed scripts, or native build problems.
- Remember that a lockfile records resolved dependency information, but scripts, platform filtering, flags, npm version, and configuration can affect what happens in practice.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
