$devvkit resources --cheatsheet npm-&-yarn-cheatsheet

npm & Yarn Cheatsheet

[tooling]

Every essential npm and Yarn command: project setup, installing packages, scripts, workspaces, publishing, and audits, with syntax and real use cases.82 commands · 6 sections

npm and Yarn are the package managers of the JavaScript ecosystem. This cheatsheet covers the commands you run daily: initializing projects, installing and updating dependencies, running scripts, workspaces and monorepos, publishing packages, and auditing for vulnerabilities.

npm commands work for both; where Yarn differs, both forms are shown.

Project Setup10

$npm init

Use case: Interactive project setup: creates package.json.Example: npm init

$npm init -y

Use case: Create package.json with defaults: skip the questions.Example: npm init -y

$npm install

Use case: Install ALL dependencies listed in package.json (creates node_modules).Example: npm install

$npm ci

Use case: Clean install from package-lock.json: exact versions, deletes node_modules first. Use in CI.Example: npm ci

$yarn init -y

Use case: Yarn equivalent of npm init -y.Example: yarn init -y

$yarn install

Use case: Install dependencies with Yarn (also yarn, just running yarn works).Example: yarn install

$yarn set version stable

Use case: Switch to Yarn Berry (modern Yarn): enables PnP and workspaces v2.Example: yarn set version stable

$npm pkg set name="myapp" version="1.0.0"

Use case: Set package.json fields from the CLI.Example: npm pkg set scripts.dev="next dev"

$npm pkg delete scripts.test

Use case: Remove a package.json field.Example: npm pkg delete scripts.test

$npm pkg get scripts

Use case: Read package.json fields.Example: npm pkg get scripts

Installing Packages17

$npm install <pkg>

Use case: Install as a production dependency.Example: npm install express

$npm install -D <pkg>

Use case: Install as a dev dependency: tools, linters, test runners.Example: npm install -D typescript vitest

$npm install <pkg>@latest

Use case: Install the latest version: major upgrades.Example: npm install next@latest

$npm install <pkg>@1.2.3

Use case: Install a specific version: pin it.Example: npm install react@18.3.1

$npm install <pkg>@^1.0.0

Use case: Install a semver range.Example: npm install lodash@^4.17.0

$npm install -g <pkg>

Use case: Install globally: CLI tools like vercel, pm2.Example: npm install -g vercel

$npm install --save-exact <pkg>

Use case: Pin the exact version in package.json: no ^ or ~.Example: npm install --save-exact react

$npm uninstall <pkg>

Use case: Remove a package.Example: npm uninstall lodash

$npm uninstall -D <pkg>

Use case: Remove a dev dependency.Example: npm uninstall -D vitest

$npm ls

Use case: List the installed dependency tree: what is actually installed?Example: npm ls

$npm ls --depth=0

Use case: Top-level dependencies only: the readable tree.Example: npm ls --depth=0

$npm ls <pkg>

Use case: Why is this package installed? Show its dependents.Example: npm ls lodash

$yarn add <pkg>

Use case: Yarn install: same as npm install.Example: yarn add express

$yarn add -D <pkg>

Use case: Yarn dev dependency.Example: yarn add -D typescript

$yarn remove <pkg>

Use case: Yarn uninstall.Example: yarn remove lodash

$npm install <github:user/repo>

Use case: Install directly from GitHub: unpublished or forked packages.Example: npm install github:user/forked-lib

$npm install <pkg> --no-save

Use case: Install without touching package.json: try a package first.Example: npm install --no-save zod

Scripts & Running13

$npm run <script>

Use case: Run any script from package.json scripts.Example: npm run build

$npm run dev

Use case: Common convention: the development server.Example: npm run dev

$npm test

Use case: Special script: runs without npm run.Example: npm test

$npm start

Use case: Special script: the production entry point.Example: npm start

$npm run <script> -- --flag

Use case: Pass flags through to the underlying command.Example: npm run build -- --watch

$npm run --silent <script>

Use case: Suppress npm's own output: cleaner CI logs.Example: npm run --silent test

$npm run <script> --if-present

Use case: Run only if the script exists: safe chaining in CI.Example: npm run lint --if-present

$npx <cmd>

Use case: Run a package WITHOUT installing it: one-off tools.Example: npx eslint src/

$npx <pkg>@latest

Use case: Run the latest version of a CLI.Example: npx create-next-app@latest myapp

$npx --yes <pkg>

Use case: Skip the install prompt in CI.Example: npx --yes prettier --check .

$npm exec <cmd>

Use case: The modern form of npx.Example: npm exec prettier -- --write .

$yarn run <script>

Use case: Yarn script runner: bare yarn <script> also works.Example: yarn run build

$yarn dlx <cmd>

Use case: Yarn's npx equivalent.Example: yarn dlx create-next-app@latest myapp

Workspaces & Monorepos10

$"workspaces": ["packages/*"]

Use case: Declare workspaces in package.json: monorepo setup.Example: "workspaces": ["packages/*", "apps/*"]

$npm install (with workspaces)

Use case: Installs all workspaces: hoists shared deps to the root.Example: npm install

$npm run <script> -w <workspace>

Use case: Run a script in one workspace.Example: npm run test -w packages/utils

$npm run <script> --workspaces

Use case: Run a script in ALL workspaces.Example: npm run lint --workspaces

$npm install <pkg> -w packages/utils

Use case: Install a dependency into a specific workspace.Example: npm install zod -w packages/utils

$npm ls --workspaces

Use case: List all workspace dependencies.Example: npm ls --workspaces

$yarn workspaces list

Use case: List workspaces (Yarn Berry).Example: yarn workspaces list

$yarn workspace packages/utils test

Use case: Run a script in a specific Yarn workspace.Example: yarn workspace packages/utils test

$npm pack

Use case: Create a tarball of the current package: preview what would be published.Example: npm pack

$npm pack --dry-run

Use case: List files that would be packed: check what ships.Example: npm pack --dry-run

Publishing & Registry16

$npm login

Use case: Authenticate to the registry.Example: npm login

$npm whoami

Use case: Who is logged in?Example: npm whoami

$npm publish

Use case: Publish the package to the registry.Example: npm publish

$npm publish --access public

Use case: Publish a scoped package publicly.Example: npm publish --access public

$npm publish --tag beta

Use case: Publish under a dist-tag: beta releases.Example: npm publish --tag beta

$npm version patch

Use case: Bump the version (1.0.0 → 1.0.1) and create a git tag.Example: npm version patch

$npm version minor / major

Use case: Bump minor (new features) or major (breaking changes).Example: npm version minor

$npm version prerelease --preid=beta

Use case: Pre-release version: 1.0.0-beta.1.Example: npm version prerelease --preid=beta

$npm deprecate <pkg>@<version> "message"

Use case: Warn users a version is deprecated.Example: npm deprecate mylib@1.0.0 "use v2"

$npm unpublish <pkg>@<version>

Use case: Remove a published version: with serious restrictions.Example: npm unpublish mylib@1.0.0

$npm dist-tag ls <pkg>

Use case: List distribution tags.Example: npm dist-tag ls react

$npm dist-tag add <pkg>@1.0.0 latest

Use case: Move a tag to a version.Example: npm dist-tag add mylib@1.0.1 latest

$npm config set registry https://npm.pkg.github.com/

Use case: Point npm at a different registry: GitHub Packages, private mirrors.Example: npm config set registry https://npm.pkg.github.com/ --scope=@myorg

$npm view <pkg>

Use case: Show a package's registry info: versions, deps.Example: npm view react

$npm view <pkg> versions

Use case: All published versions of a package.Example: npm view react versions

$npm search <term>

Use case: Search the registry.Example: npm search rate limiter

Maintenance & Audits16

$npm outdated

Use case: List packages with newer versions available.Example: npm outdated

$npm update

Use case: Update packages within your declared semver ranges.Example: npm update

$npm update <pkg>

Use case: Update a single package.Example: npm update lodash

$npm audit

Use case: Check the dependency tree against known vulnerabilities.Example: npm audit

$npm audit fix

Use case: Apply safe, non-breaking fixes automatically.Example: npm audit fix

$npm audit fix --force

Use case: Apply breaking-version fixes: last resort, may break things.Example: npm audit fix --force

$npm audit --json

Use case: Machine-readable audit output: parse in CI.Example: npm audit --json

$npm dedupe

Use case: Flatten duplicate packages: shrink node_modules.Example: npm dedupe

$npm cache clean --force

Use case: Clear the npm cache: fixes corrupt-cache errors.Example: npm cache clean --force

$npm cache verify

Use case: Verify and clean the cache safely.Example: npm cache verify

$npm prune

Use case: Remove extraneous packages not in package.json.Example: npm prune

$npm prune --production

Use case: Remove devDependencies: production deploys.Example: npm prune --production

$npm explain <pkg>

Use case: Why is this package in my tree? Show the dependency chain.Example: npm explain lodash

$npm doctor

Use case: Diagnose common npm problems: registry, cache, permissions.Example: npm doctor

$npm root -g

Use case: Where are global packages installed?Example: npm root -g

$npm run env

Use case: Show environment variables available to scripts.Example: npm run env

npm & Yarn Cheatsheet

Every essential npm and Yarn command: project setup, installing packages, scripts, workspaces, publishing, and audits, with syntax and real use cases.

npm commands work for both; where Yarn differs, both forms are shown.

Project Setup

npm init: Interactive project setup: creates package.json.

Example: npm init

npm init -y: Create package.json with defaults: skip the questions.

Example: npm init -y

npm install: Install ALL dependencies listed in package.json (creates node_modules).

Example: npm install

npm ci: Clean install from package-lock.json: exact versions, deletes node_modules first. Use in CI.

Example: npm ci

yarn init -y: Yarn equivalent of npm init -y.

Example: yarn init -y

yarn install: Install dependencies with Yarn (also yarn, just running yarn works).

Example: yarn install

yarn set version stable: Switch to Yarn Berry (modern Yarn): enables PnP and workspaces v2.

Example: yarn set version stable

npm pkg set name="myapp" version="1.0.0": Set package.json fields from the CLI.

Example: npm pkg set scripts.dev="next dev"

npm pkg delete scripts.test: Remove a package.json field.

Example: npm pkg delete scripts.test

npm pkg get scripts: Read package.json fields.

Example: npm pkg get scripts

Installing Packages

npm install <pkg>: Install as a production dependency.

Example: npm install express

npm install -D <pkg>: Install as a dev dependency: tools, linters, test runners.

Example: npm install -D typescript vitest

npm install <pkg>@latest: Install the latest version: major upgrades.

Example: npm install next@latest

npm install <pkg>@1.2.3: Install a specific version: pin it.

Example: npm install react@18.3.1

npm install <pkg>@^1.0.0: Install a semver range.

Example: npm install lodash@^4.17.0

npm install -g <pkg>: Install globally: CLI tools like vercel, pm2.

Example: npm install -g vercel

npm install --save-exact <pkg>: Pin the exact version in package.json: no ^ or ~.

Example: npm install --save-exact react

npm uninstall <pkg>: Remove a package.

Example: npm uninstall lodash

npm uninstall -D <pkg>: Remove a dev dependency.

Example: npm uninstall -D vitest

npm ls: List the installed dependency tree: what is actually installed?

Example: npm ls

npm ls --depth=0: Top-level dependencies only: the readable tree.

Example: npm ls --depth=0

npm ls <pkg>: Why is this package installed? Show its dependents.

Example: npm ls lodash

yarn add <pkg>: Yarn install: same as npm install.

Example: yarn add express

yarn add -D <pkg>: Yarn dev dependency.

Example: yarn add -D typescript

yarn remove <pkg>: Yarn uninstall.

Example: yarn remove lodash

npm install <github:user/repo>: Install directly from GitHub: unpublished or forked packages.

Example: npm install github:user/forked-lib

npm install <pkg> --no-save: Install without touching package.json: try a package first.

Example: npm install --no-save zod

Scripts & Running

npm run <script>: Run any script from package.json scripts.

Example: npm run build

npm run dev: Common convention: the development server.

Example: npm run dev

npm test: Special script: runs without npm run.

Example: npm test

npm start: Special script: the production entry point.

Example: npm start

npm run <script> -- --flag: Pass flags through to the underlying command.

Example: npm run build -- --watch

npm run --silent <script>: Suppress npm's own output: cleaner CI logs.

Example: npm run --silent test

npm run <script> --if-present: Run only if the script exists: safe chaining in CI.

Example: npm run lint --if-present

npx <cmd>: Run a package WITHOUT installing it: one-off tools.

Example: npx eslint src/

npx <pkg>@latest: Run the latest version of a CLI.

Example: npx create-next-app@latest myapp

npx --yes <pkg>: Skip the install prompt in CI.

Example: npx --yes prettier --check .

npm exec <cmd>: The modern form of npx.

Example: npm exec prettier -- --write .

yarn run <script>: Yarn script runner: bare yarn <script> also works.

Example: yarn run build

yarn dlx <cmd>: Yarn's npx equivalent.

Example: yarn dlx create-next-app@latest myapp

Workspaces & Monorepos

"workspaces": ["packages/*"]: Declare workspaces in package.json: monorepo setup.

Example: "workspaces": ["packages/*", "apps/*"]

npm install (with workspaces): Installs all workspaces: hoists shared deps to the root.

Example: npm install

npm run <script> -w <workspace>: Run a script in one workspace.

Example: npm run test -w packages/utils

npm run <script> --workspaces: Run a script in ALL workspaces.

Example: npm run lint --workspaces

npm install <pkg> -w packages/utils: Install a dependency into a specific workspace.

Example: npm install zod -w packages/utils

npm ls --workspaces: List all workspace dependencies.

Example: npm ls --workspaces

yarn workspaces list: List workspaces (Yarn Berry).

Example: yarn workspaces list

yarn workspace packages/utils test: Run a script in a specific Yarn workspace.

Example: yarn workspace packages/utils test

npm pack: Create a tarball of the current package: preview what would be published.

Example: npm pack

npm pack --dry-run: List files that would be packed: check what ships.

Example: npm pack --dry-run

Publishing & Registry

npm login: Authenticate to the registry.

Example: npm login

npm whoami: Who is logged in?

Example: npm whoami

npm publish: Publish the package to the registry.

Example: npm publish

npm publish --access public: Publish a scoped package publicly.

Example: npm publish --access public

npm publish --tag beta: Publish under a dist-tag: beta releases.

Example: npm publish --tag beta

npm version patch: Bump the version (1.0.0 → 1.0.1) and create a git tag.

Example: npm version patch

npm version minor / major: Bump minor (new features) or major (breaking changes).

Example: npm version minor

npm version prerelease --preid=beta: Pre-release version: 1.0.0-beta.1.

Example: npm version prerelease --preid=beta

npm deprecate <pkg>@<version> "message": Warn users a version is deprecated.

Example: npm deprecate mylib@1.0.0 "use v2"

npm unpublish <pkg>@<version>: Remove a published version: with serious restrictions.

Example: npm unpublish mylib@1.0.0

npm dist-tag ls <pkg>: List distribution tags.

Example: npm dist-tag ls react

npm dist-tag add <pkg>@1.0.0 latest: Move a tag to a version.

Example: npm dist-tag add mylib@1.0.1 latest

npm config set registry https://npm.pkg.github.com/: Point npm at a different registry: GitHub Packages, private mirrors.

Example: npm config set registry https://npm.pkg.github.com/ --scope=@myorg

npm view <pkg>: Show a package's registry info: versions, deps.

Example: npm view react

npm view <pkg> versions: All published versions of a package.

Example: npm view react versions

npm search <term>: Search the registry.

Example: npm search rate limiter

Maintenance & Audits

npm outdated: List packages with newer versions available.

Example: npm outdated

npm update: Update packages within your declared semver ranges.

Example: npm update

npm update <pkg>: Update a single package.

Example: npm update lodash

npm audit: Check the dependency tree against known vulnerabilities.

Example: npm audit

npm audit fix: Apply safe, non-breaking fixes automatically.

Example: npm audit fix

npm audit fix --force: Apply breaking-version fixes: last resort, may break things.

Example: npm audit fix --force

npm audit --json: Machine-readable audit output: parse in CI.

Example: npm audit --json

npm dedupe: Flatten duplicate packages: shrink node_modules.

Example: npm dedupe

npm cache clean --force: Clear the npm cache: fixes corrupt-cache errors.

Example: npm cache clean --force

npm cache verify: Verify and clean the cache safely.

Example: npm cache verify

npm prune: Remove extraneous packages not in package.json.

Example: npm prune

npm prune --production: Remove devDependencies: production deploys.

Example: npm prune --production

npm explain <pkg>: Why is this package in my tree? Show the dependency chain.

Example: npm explain lodash

npm doctor: Diagnose common npm problems: registry, cache, permissions.

Example: npm doctor

npm root -g: Where are global packages installed?

Example: npm root -g

npm run env: Show environment variables available to scripts.

Example: npm run env

Frequently asked questions

What is the difference between npm and Yarn?

Both install and manage dependencies. Yarn 1.x added parallel installs and a global cache; Yarn Berry (3+) uses Plug'n'Play and workspaces. npm is bundled with Node and is the default choice for most projects.

What is the difference between dependencies and devDependencies?

dependencies are needed at runtime and installed in production. devDependencies are only for development: build tools, linters, and test frameworks. Use npm install --save-dev to add dev dependencies.

How do I update outdated packages?

Run npm outdated to list outdated packages, then npm update to update within your version ranges. For major version upgrades use npm install <pkg>@latest or tools like npm-check-updates (ncu).

What is npm audit and how do I fix vulnerabilities?

npm audit checks your dependency tree against the advisory database. npm audit fix applies safe, compatible updates automatically, and npm audit fix --force takes breaking updates as a last resort.