npm install installs and updates packages. npm ci will only operate if there is a package-lock file and cleans out node_modules completely every time, so there's no chance of old packages lingering around... but also gives you exactly what is in the lock file. The Circle CI node orb operates this way. and falls back to npm install only if there's not a lock file.