NPM-EXEC(1)

📦

version 12.2.1 · 27 versions

💅 npm-exec(1) — like, the whole manual, but make it make sense

okay bestie, sit down, grab a strawberry 🍓 — this is npm-exec, from the npm manual (yes, that NPM-EXEC(1) header up top, that's us). it's genuinely one of the most useful little commands in the whole npm-verse and i'm obsessed. let's go ✨

🌸 NAME 🌸

npm-exec — run a command from a local or remote npm package 🫶

✨ Synopsis ✨

npm exec -- <pkg>[@<version>] [args...]
npm exec --package=<pkg>[@<version>] -- <cmd> [args...]
npm exec -c '<cmd> [args...]'
npm exec --package=foo -c '<cmd> [args...]'

alias: x

so yeah, x is the alias. npm x is giving main character energy, honestly. 👑

🦋 Description 🦋

this command lets you run an arbitrary command from an npm package — either one that's installed locally, or one fetched remotely — in a similar context as running it via npm run. no cap, that's the whole vibe. 💖

run it without positional arguments or --call, and it lets you interactively run commands in the same sort of shell environment that package.json scripts are run in. basically a lil hangout shell. 🧚

⚠️ heads up: interactive mode is not supported in CI environments when standard input is a TTY, to prevent hangs. it's looking out for you, bestie.

whatever packages you specify with the --package option get provided in the PATH of the executed command, along with any locally installed package executables. and yes — --package can be specified multiple times, so your command runs in an environment where all those packages are available. the more the merrier 💅

if any requested packages aren't present in the local project dependencies, then a prompt is printed. you can suppress that prompt by providing either --yes or --no. when standard input is not a TTY, or a CI environment is detected, --yes is assumed. the requested packages get installed to a folder in the npm cache, which is added to the PATH environment variable in the executed process. 🎀

package names provided without a specifier will be matched with whatever version exists in the local project. package names with a specifier will only be considered a match if they have the exact same name and version as the local dependency. exact, bestie. no vibes-based matching. ✨

if no -c or --call option is provided, then the positional arguments are used to generate the command string. and if no --package options are provided, npm tries to determine the executable name from the package specifier given as the first positional argument, using this heuristic:

if the package has a single entry in its bin field in package.json, or if all entries are aliases of the same command, then that command will be used.
if the package has multiple bin entries, and one of them matches the unscoped portion of the name field, then that command will be used.
if this does not result in exactly one option (either because there are no bin entries, or none of them match the name of the package), then npm exec exits with an error. 💀

to run a binary other than the named binary, specify one or more --package options — that prevents npm from inferring the package from the first command argument. lowkey the move. 🫶

🔥 npx vs npm exec 🔥

when run via the npx binary, all flags and options must be set prior to any positional arguments. when run via npm exec, a double-hyphen -- flag can be used to suppress npm's parsing of switches and options that should be sent to the executed command. 🎯

for example:

$ npx foo@latest bar --package=@npmcli/foo

in this case, npm will resolve the foo package name, and run the following command:

$ foo bar --package=@npmcli/foo

since the --package option comes after the positional arguments, it's treated as an argument to the executed command. it's just along for the ride at that point. 🙈

in contrast, due to npm's argument parsing logic, running this command is different:

$ npm exec foo@latest bar --package=@npmcli/foo

in this case, npm will parse the --package option first, resolving the @npmcli/foo package. then it will execute the following command in that context:

$ foo@latest bar

the double-hyphen character is recommended to explicitly tell npm to stop parsing command line options and switches. the following command would thus be equivalent to the npx command above:

$ npm exec -- foo@latest bar --package=@npmcli/foo

see? iconic. use your --, bestie. 💖

🎀 Configuration 🎀

`package`

Default: (empty)
Type: String (can be set multiple times)

the package or packages to install for npm help exec. yes, that's literally what the manual says, i'm not making it up 😭

`call`

Default: ""
Type: String

optional companion option for npm exec, npx that allows for specifying a custom command to be run along with the installed packages.

npm exec --package yo --package generator-node --call "yo node"

look at that. two packages, one call. teamwork. 🌈

`workspace`

Default: (empty)
Type: String (can be set multiple times)

enable running a command in the context of the configured workspaces of the current project, while filtering by running only the workspaces defined by this configuration option.

valid values for the workspace config are either:

workspace names
path to a workspace directory
path to a parent workspace directory (this will result in selecting all workspaces within that folder)

when set for the npm init command, this may be set to the folder of a workspace which does not yet exist — so it creates the folder and sets it up as a brand new workspace within the project. manifesting a workspace into existence ✨

🚨 this value is not exported to the environment for child processes.

`workspaces`

Default: null
Type: null or Boolean

set to true to run the command in the context of all configured workspaces.

explicitly setting this to false will cause commands like install to ignore workspaces altogether. when not set explicitly:

commands that operate on the node_modules tree (install, update, etc.) will link workspaces into the node_modules folder.
commands that do other things (test, exec, publish, etc.) will operate on the root project, unless one or more workspaces are specified in the workspace config.

🚨 this value is not exported to the environment for child processes.

`include-workspace-root`

Default: false
Type: Boolean

include the workspace root when workspaces are enabled for a command.

when false, specifying individual workspaces via the workspace config, or all workspaces via the workspaces flag, will cause npm to operate only on the specified workspaces, and not on the root project. root project stays home, no note. 💅

🚨 this value is not exported to the environment for child processes.

`allow-scripts`

Default: ""
Type: String (can be set multiple times)

comma-separated list of packages whose install-time lifecycle scripts (preinstall, install, postinstall, and prepare for non-registry dependencies) are allowed to run. 🔐

this setting is intended for one-off and global contexts: npm exec, npx, and npm install -g, where no project package.json is involved. for team-wide policy in a project, use the allowScripts field in package.json (which also supports explicit denials), or configure it in .npmrc. passing --allow-scripts on the command line during a project-scoped npm install, ci, update, or rebuild is an error. 💀

each name is matched against a dependency's resolved identity, not against the package's self-reported name. --ignore-scripts and --dangerously-allow-all-scripts both override this setting. 🫶

🚨 this value is not exported to the environment for child processes.

`strict-allow-scripts`

Default: false
Type: Boolean

if true, turn the install-script policy from a warning into a hard error: any dependency with install scripts that isn't covered by allowScripts will fail the install instead of being blocked with a warning. no more soft-launching your warnings, we're being serious now 🔥

dependencies explicitly denied with false in allowScripts are always silently skipped; this setting only affects unreviewed entries (packages with install scripts that are neither approved nor denied). --ignore-scripts and --dangerously-allow-all-scripts both override this setting.

optional dependencies that can't be installed on the current platform or engine (a non-matching os, cpu, or libc) are not flagged, because their install scripts never run. they're not even invited to the party 🎈

`dangerously-allow-all-scripts`

Default: false
Type: Boolean

if true, bypass the allowScripts policy entirely and run every dependency install script regardless of whether it was approved or denied. 😭

⚠️ big scary warning energy: this is intended as a migration escape hatch only, and its use is strongly discouraged. --ignore-scripts still takes precedence over this setting. the option literally has "dangerously" in the name, bestie, that's your vibe check right there 💀

⭐ Examples ⭐

run the version of tap in the local dependencies, with the provided arguments:

$ npm exec -- tap --bail test/foo.js
$ npx tap --bail test/foo.js

run a command other than the command whose name matches the package name, by specifying a --package option:

$ npm exec --package=foo -- bar --bar-argument
# ~ or ~
$ npx --package=foo bar --bar-argument

run an arbitrary shell script, in the context of the current project:

$ npm x -c 'eslint && say "hooray, lint passed"'
$ npx -c 'eslint && say "hooray, lint passed"'

say "hooray, lint passed" — truly the most iconic part of this entire manpage, and i will not be taking questions 🌸

🧚 Workspaces support 🧚

you may use the workspace ⟨/using-npm/config#workspace⟩ or workspaces ⟨/using-npm/config#workspaces⟩ configs in order to run an arbitrary command from an npm package (either one installed locally, or fetched remotely) in the context of the specified workspaces. 🦋

if no positional argument or --call option is provided, it will open an interactive subshell in the context of each of these configured workspaces, one at a time.

given a project with configured workspaces, e.g:

+-- package.json
`-- packages
   +-- a
   |   `-- package.json
   +-- b
   |   `-- package.json
   `-- c
       `-- package.json

assuming the workspace configuration is properly set up at the root level package.json file. e.g:

{
    "workspaces": [ "./packages/*" ]
}

you can execute an arbitrary command from a package in the context of each of the configured workspaces when using the workspaces config options ⟨/using-npm/config#workspace⟩. in this example we're using eslint to lint any js file found within each workspace folder:

npm exec --ws -- eslint ./*.js

look at it go. all the workspaces, at once. ✨

🌈 Filtering workspaces 🌈

it's also possible to execute a command in a single workspace using the workspace config along with a name or directory path:

npm exec --workspace=a -- eslint ./*.js

the workspace config can also be specified multiple times in order to run a specific script in the context of multiple workspaces. when defining values for the workspace config on the command line, it's also possible to use -w as a shorthand, e.g:

npm exec -w a -w b -- eslint ./*.js

this last command will run the eslint command in both ./packages/a and ./packages/b folders. two birds, one lint. 🐦🐦

💜 Compatibility with Older `npx` Versions 💜

the npx binary was rewritten in npm v7.0.0, and the standalone npx package was deprecated at that time. 😭 (rip standalone npx, gone but not forgotten)

npx uses the npm exec command instead of a separate argument parser and install process, with some affordances to maintain backwards compatibility with the arguments it accepted in previous versions. so your old muscle memory still mostly works, bestie, they thought of you 🫶

(no i'm not done — part 2 is coming, don't you dare close the tab) 🎀

okay so this resulted in some shifts in its functionality: 💅

Any npm config value may be provided. — like, literally any npm config value, bestie. go off.
npx prompts before installing anything — this is to prevent security and user-experience problems from mistyping package names. Suppress this prompt with the -y or --yes option. ✨
--no-install — this option is deprecated, and will be converted to --no. 💀
Shell fallback functionality is removed — as it is not advisable. periodt.
-p — this argument is a shorthand for --parseable in npm, but shorthand for --package in npx. This is maintained, but only for the npx executable. iykyk 🫶
--ignore-existing — this option is removed. Locally installed bins are always present in the executed process PATH.
--npm — this option is removed. npx will always use the npm it ships with.
--node-arg and -n — these options are removed.
--always-spawn — this option is redundant, and thus removed.
--shell — this option is replaced with --script-shell, but maintained in the npx executable for backwards compatibility.

💾 A note on caching ✨

The npm cli utilizes its internal package cache when using the package name specified. You can use the following to change how and when the cli uses this cache. See npm help cache for more on how the cache works. 🧚

⚡ prefer-online

Forces staleness checks for packages, making the cli look for updates immediately even if the package is already in the cache.

🛰️ prefer-offline

Bypasses staleness checks for packages. Missing data will still be requested from the server. To force full offline mode, use offline.

📴 offline

Forces full offline mode. Any packages not locally cached will result in an error.

🧵 workspace

Default: — (no value shown in the original, bestie)
Type: String (can be set multiple times)

Enable running a command in the context of the configured workspaces of the current project while filtering by running only the workspaces defined by this configuration option.

Valid values for the workspace config are either:

Workspace names
Path to a workspace directory
Path to a parent workspace directory (will result to selecting all of the nested workspaces)

This value is not exported to the environment for child processes.

🧶 workspaces

Alias: --ws
Type: Boolean
Default: false

Run scripts in the context of all configured workspaces for the current project.

👀 See Also 🫶

npm help run
npm help scripts
npm help test
npm help start
npm help restart
npm help stop
npm help config
npm help workspaces
npm help npx

okay that’s the whole vibe, bestie — this page is from NPM@12.2.1, dated October 2026, and it’s NPM-EXEC(1). ily, go run your stuff ✨💜

📦 where this page comes from

arch rolling: npm 12.2.1-1 · Artistic-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-06: a language model's rewrite of the original, under its terms

NPM-EXEC(1)

💅 npm-exec(1) — like, the whole manual, but make it make sense

🌸 NAME 🌸

✨ Synopsis ✨

🦋 Description 🦋

🔥 npx vs npm exec 🔥

🎀 Configuration 🎀

package

call

workspace

workspaces

include-workspace-root

allow-scripts

strict-allow-scripts

dangerously-allow-all-scripts

⭐ Examples ⭐

🧚 Workspaces support 🧚

🌈 Filtering workspaces 🌈

💜 Compatibility with Older npx Versions 💜

💾 A note on caching ✨

⚡ prefer-online

🛰️ prefer-offline

📴 offline

🧵 workspace

🧶 workspaces

👀 See Also 🫶

`package`

`call`

`workspace`

`workspaces`

`include-workspace-root`

`allow-scripts`

`strict-allow-scripts`

`dangerously-allow-all-scripts`

💜 Compatibility with Older `npx` Versions 💜