npm install reads package.json to create a list of dependencies and uses package-lock.json to inform which versions of these dependencies to install. If a dependency is not in package-lock.json it will be added by npm install.
npm ci (named after Continuous Integration) installs dependencies directly from package-lock.json and uses package.json only to validate that there are no mismatched versions. If any dependencies are missing or have incompatible versions, it will throw an error.
參考文章：更詳細(xì)的區(qū)別請(qǐng)閱讀此文章
推薦文章：從package-lock看npm版本鎖定相關(guān)知識(shí)
