What npm install Actually Does Under the Hood

Running 'npm install' is far more complex than a simple file download — it acts as a dependency solver, registry client, filesystem layout engine, and lockfile writer. npm reads your package.json constraints, recursively resolves all direct and transitive dependencies, and materializes the resulting graph into node_modules. When no lockfile exists, npm resolves version ranges against live registry metadata; with a lockfile present, it reuses previously recorded versions and dependency edges. The integrity hash in a lockfile verifies that a downloaded tarball matches the locked one, but does not guarantee a package is safe or trustworthy. For consistent, reproducible installs — especially in CI environments — 'npm ci' is generally preferred, as it installs strictly from the lockfile and fails if it disagrees with package.json.