Why We Ditched npm install in Production (And You Should Too)

Two years ago, we made a change that cut our deployment failures by 80%. It wasn't a fancy new architecture. It wasn't a microservices overhaul. It was a simple switch from npm install to npm ci --omit=dev in our production Docker containers. That single change saved us from 4 dependency-related incidents in the first year alone. Here's why it matters, how it works, and why your team should make the switch today. The Problem: npm install is a Liability in Production Let's be honest—npm install is great for local development. It's flexible, forgiving, and gets the job done. But in production? It's a ticking time bomb. Here's what can (and did) go wrong: The Package Lock That Wasn't npm install doesn't respect your package-lock.json the way you think it does. If your lock file is out of sync with your package.json, npm will update dependencies behind your back. We once had a patch release of a logging library introduce a breaking change that crashed our entire API fleet. The lock file said one version. The container installed another. The "It Works On My Machine" Nightmare Local installs, CI installs, and production installs can all yield different dependency trees. Different npm versions, different registry responses, different caching behavior—it's chaos. We spent 3 days debugging a staging vs. production discrepancy that turned out to be a transitive dependency with a slightly different semantic versioning resolution. The Time Tax npm install is slow. It checks versions, resolves conflicts, and installs development dependencies you'll never use in production. Every minute spent installing is a minute your deployment is vulnerable. The Solution: npm ci + --omit=dev The npm team gave us a production-ready alternative years ago, yet so many teams still sleep on it. What npm ci Does Strictly respects package-lock.json: If the lock file doesn't match package.json, npm throws an error and fails the build. No silent updates. Installs from the lock file only: It skips depe