Cheatsheet npm / yarn

npm init       # interactive
npm init -y    # accept defaults
npm init @scope/app # template

Create package.json.

npm install         # everything
npm install lodash  # dependency
npm i -D jest       # devDependency
npm i -g typescript # global
npm i lodash@4.17.21 # fixed version

Add dependencies.

npm uninstall lodash
npm update        # update everything
npm outdated      # see outdated
npm audit         # vulnerabilities
npm audit fix     # auto fix

Maintain dependencies.

npm list         # deps tree
npm list --depth=0 # direct only
npm info lodash  # package info
npm view lodash versions

Explore dependencies.

yarn init         # create project
yarn             # install everything
yarn add lodash   # dependency
yarn add -D jest  # devDependency
yarn remove lodash  # remove

Classic Yarn (v1).

corepack enable
yarn set version stable
yarn install    # PnP by default
yarn dlx create-react-app my-app
yarn workspaces foreach run build

Modern Yarn.

yarn list        # dependencies
yarn outdated    # outdated
yarn upgrade     # update
yarn info lodash  # details
yarn why lodash   # who depends on it

Manage packages.

yarn cache dir    # see cache
yarn cache clean  # clear cache
yarn install --force # reinstall
node_modules/.yarn-state.yml

Yarn cache.

// package.json
"scripts": {
  "dev": "vite",
  "build": "vite build",
  "test": "jest --coverage",
  "lint": "eslint src/"
}

Scripts in package.json.

npm run dev
npm run build
npm test      # shortcut (no run)
npm start     # shortcut
yarn dev      # yarn (no run)

Run scripts.

"scripts": {
  "prebuild": "npm run clean",
  "build": "webpack",
  "postbuild": "npm run copy-assets"
}
// pre/post run automatically

Lifecycle hooks.

npm run test -- --watch
npm run build -- --mode production
yarn test --watch  # yarn does not need --

// In the script: use process.argv

Arguments for scripts.

"lodash": "4.17.21"  # exact
"lodash": "^4.17.0"  # compat (minor)
"lodash": "~4.17.0"  # patch only
"lodash": "*"       # any
"lodash": ">=4.0 <5.0"

Semantic versioning.

package-lock.json (npm)
yarn.lock (yarn)

# ALWAYS commit them!
# Guarantees reproducible builds
# npm ci → installs exactly from lock

Lock files.

npm ci       # clean, from lock (CI)
npm install  # may update lock

# npm ci:
# • Removes node_modules
# • Installs exactly from lock
# • Faster in CI

Important differences.

"optionalDependencies": {
  "fsevents": "^2.3.0"
}

"peerDependencies": {
  "react": ">=17.0.0"
}

Special dependency types.

npm login
npm publish
npm publish --access public
npm version patch  # 1.0.0 → 1.0.1
npm version minor  # 1.0.1 → 1.1.0
npm version major  # 1.1.0 → 2.0.0

Publish to the npm registry.

// package.json
"name": "@scope/package",
"version": "1.0.0",
"main": "dist/index.js",
"files": ["dist/"],
"prepublishOnly": "npm run build"

Configure for publishing.

npm publish --registry http://local:4873

// .npmrc
registry=https://registry.npmjs.org/
@scope:registry=http://private:4873
//token=${NPM_TOKEN}

Use a private registry.

npx create-react-app my-app
npx prettier --write .
npx http-server dist/
npx cowsay "Hello"

# Runs without installing globally

Run temporary packages.

// root package.json
"workspaces": ["packages/*"]

npm run build --workspace=pkg-a
yarn workspaces foreach run build
yarn workspace pkg-a add lodash

Monorepo with workspaces.

npm audit         # check vulns
npm audit fix     # auto fix
npm audit fix --force # breaking
yarn audit        # yarn
npm config set audit-level high

Security auditing.

npm config list
npm config set save-exact true
npm config set prefix ~/.npm-global

// project .npmrc:
save-exact=true
engine-strict=true

npm configuration.