Install a package dependency

Medium risk

What do risk levels mean?

Read-only: Inspects state without changing anything.
Low risk: Reversible with a routine follow-up command.
Medium risk: Changes state; undo path documented.
Destructive: Deletes or overwrites; confirmation required.

Inspects the current declaration, then installs a package as a runtime dependency and records the resolved version in package metadata and the lockfile.

nodenpmdependency

Parameters

package

Trusted npm package name without a version or tag.

version

Exact package version or registry tag to install.

Commands

Inspect all direct dependency declarations before installation

$npm pkg get dependencies devDependencies optionalDependencies peerDependencies

Install the selected package without executing lifecycle scripts

$npm install --ignore-scripts "<package>@latest"

Verification

$npm ls "<package>" --depth=0

The package appears at the project root with its resolved version.

Undo

Not undoable

A universal undo cannot distinguish a newly added package from a pre-existing declaration or restore its exact prior version and dependency section.

Pitfalls

Lifecycle scripts are disabled; packages that require build or install scripts may not work until those scripts are reviewed and run separately.
To recover tracked project state, restore package.json and package-lock.json from version control, then run npm ci --ignore-scripts.