What is the NPM equivalent of “yarn install –frozen-lockfile”?

You can use npm ci.

npm ci bypasses a package’s package.json to install modules from a package’s lockfile. This ensures reproducible builds—you are getting exactly what you expect on every install.

https://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable