NPM - Add to package.json but don't install

The correct way to only update package.json, without any other side-effects is:

npm install --save --package-lock-only --no-package-lock <package>

Use --package-lock-only to prevent writing to node_modules.

The --package-lock-only argument will only update the package-lock.json, instead of checking node_modules and downloading dependencies.

Then, use --no-package-lock to prevent the creation of the lock file:

The --no-package-lock argument will prevent npm from creating a package-lock.json file. When running with package-lock's disabled npm will not automatically prune your node modules when installing.

See npm install docs for more.