/compare /npm/npm-ci-vs-npm-install

npm ci vs npm install: differences and when to use each

updated 2026-10-20

tool: npm
compares: npm ci vs npm install

Use npm ci in CI and Docker builds, and npm install while developing. npm ci installs exactly the versions in package-lock.json, removes any existing node_modules first, never writes to package.json or the lockfile, and fails if the two disagree. npm install resolves the ranges in package.json and may update the lockfile.

Criterion by criterion

Criterion	npm ci	npm install
Lockfile required	yes, fails without package-lock.json	no, creates it if missing
Lockfile out of sync with package.json	fails	updates the lockfile
Writes package.json / lockfile	never	yes, when adding or updating
Existing node_modules	deleted first	reused and updated
Install a single package	no	yes (npm install pkg)
Reproducible builds	yes	only if the lockfile is committed and unchanged
Typical use	CI, Docker images, deployments	local development

npm ci without a lockfile

bash

npm init -y >/dev/null
npm pkg set dependencies.lodash="^4.17.21"
npm ci

Output · exit 1

npm error code EUSAGE
npm error
npm error The `npm ci` command can only install with an existing package-lock.json or
npm error npm-shrinkwrap.json with lockfileVersion >= 1. Run an install with npm@5 or
npm error later to generate a package-lock.json file, then try again.
npm error
npm error Clean install a project
npm error
npm error Usage:
npm error npm ci
npm error
npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts]
npm error [--allow-directory <all|none|root>] [--allow-file <all|none|root>]
npm error [--allow-git <all|none|root>] [--allow-remote <all|none|root>]
npm error [--allow-scripts <package-list> [--allow-scripts <package-list> ...]]
npm error [--strict-allow-scripts] [--dangerously-allow-all-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
npm error   --install-strategy
npm error     Sets the strategy for installing packages in node_modules.
npm error
npm error   --legacy-bundling
npm error     Instead of hoisting package installs in `node_modules`, install packages
npm error
npm error   --global-style
npm error     Only install direct dependencies in the top level `node_modules`,
npm error
npm error   --omit
npm error     Dependency types to omit from the installation tree on disk.
npm error
npm error   --include
npm error     Option that allows for defining which types of dependencies to install.
npm error
npm error   --strict-peer-deps
npm error     If set to `true`, and `--legacy-peer-deps` is not set, then _any_
npm error
npm error   --foreground-scripts
npm error     Run all build scripts (ie, `preinstall`, `install`, and
npm error
npm error   --ignore-scripts
npm error     If true, npm does not run scripts specified in package.json files.
npm error
npm error   --allow-directory
npm error     Limits the ability for npm to install dependencies from directories.
npm error
npm error   --allow-file
npm error     Limits the ability for npm to install dependencies from tarball files.
npm error
npm error   --allow-git
npm error     Limits the ability for npm to fetch dependencies from git references.
npm error
npm error   --allow-remote
npm error     Limits the ability for npm to fetch dependencies from urls.
npm error
npm error   --allow-scripts
npm error     Comma-separated list of packages whose install-time lifecycle scripts
npm error
npm error   --strict-allow-scripts
npm error     If `true`, turn the install-script policy from a warning into a hard
npm error
npm error   --dangerously-allow-all-scripts
npm error     If `true`, bypass the `allowScripts` policy entirely and run every
npm error
npm error   --audit
npm error     When "true" submit audit reports alongside the current npm command to the
npm error
npm error   --bin-links
npm error     Tells npm to create symlinks (or `.cmd` shims on Windows) for package
npm error
npm error   --fund
npm error     When "true" displays the message at the end of each `npm install`
npm error
npm error   --dry-run
npm error     Indicates that you don't want npm to make any changes and that it should
[… 18 more lines]

npm ci with a lockfile

bash

npm init -y >/dev/null
npm install --no-audit --no-fund --silent lodash@4.17.21
rm -rf node_modules
npm ci --no-audit --no-fund
npm ls lodash

Output

added 1 package in 1s
work@1.0.0 /tmp/work
└── lodash@4.17.21

Sources

commands · npmnpm install a specific version: npm install package@versionInstall an exact version with npm install package@1.2.3, a range with package@^1.2, or a dist-tag with package@next. List published versions with npm view.cheat sheets · npmnpm cheat sheet: install, run, update, publishnpm cheat sheet: init, install and uninstall, version specifiers, scripts, outdated and update, npm ci for CI, ls and explain, config and cache commands.errors · npmnpm ERR! code ERESOLVE: unable to resolve dependency treenpm fails with ERESOLVE when a package's peer dependency conflicts with the version you install. Read Found and Could not resolve, then align the versions.

Criterion by criterion

npm ci without a lockfile

npm ci with a lockfile

Sources

Related pages