Recreate dependencies from the lockfile
Medium risk
What do risk levels mean?
- Read-only
- Inspects state without changing anything.
- Low risk
- Reversible with a routine follow-up command.
- Medium risk
- Changes state; undo path documented.
- Destructive
- Deletes or overwrites; confirmation required.
Verifies that a package lock is present, then removes the existing dependency tree and installs exactly the versions recorded in package-lock.json.
nodenpmclean-install
Commands
Confirm the command is running from the intended package root
npm pkg get nameReplace node_modules from the lockfile without executing lifecycle scripts
npm ci --ignore-scriptsVerification
npm ls --depth=0Direct dependencies are present without missing or invalid package errors.
Undo
Not undoable
Extraneous or manually changed files previously under node_modules cannot be reconstructed by npm.
Pitfalls
- npm ci fails when package.json and package-lock.json disagree; update and commit the lockfile intentionally instead.
- Lifecycle scripts are disabled; packages that require build or install scripts may need separately reviewed setup afterward.