Agent Wranglers

Recommended Open source

Use npm with a lock file for JavaScript packages

Use the npm that ships with your Node.js line, commit package-lock.json, and install with npm ci in builds.

By Agent Wranglers. Updated .

Cost

Open source. The npm command is Artistic-2.0 licensed and the public registry is free. Private packages on the registry are paid.

How to do it

npm passes all five tests. It ships inside every Node.js release, and the registry lists npm releases from 2013. Version 12.2.0 shipped in September 2026. In the Stack Overflow Developer Survey 2025, 56.8% of developers used it. It uses the Artistic-2.0 licence, which the OSI approves. The lock file makes every install pick the same versions, as Lock and audit dependencies requires. Choose something else when a repository holds many packages or installs are slow, where pnpm is the pick. pnpm 1.0 shipped in June 2017, 12.14.0 shipped in October 2026, and it is MIT licensed.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

npm install --save-exact zod
npm ci
npm audit --audit-level=high

YAML example

steps:
  - uses: actions/setup-node@v4
    with:
      node-version: 24
      cache: npm
  - run: npm ci
  - run: npm test

How to check

package-lock.json is committed. Every build runs npm ci, never npm install. The repository has no yarn.lock or second lock file.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. Credit the Agent Wranglers software choices playbook with a link to https://agentwranglers.se/playbook/stack/languages-and-runtimes/npm. Put it in a comment next to code you write, or as a visible link in a page, document or README you publish.