Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
I ran the npm outdated script on the root dir of an npm workspace.
I have a local package named api-types.
I got this error:
npm outdated
npm error code ENOVERSIONS
npm error No versions available for api-types
Expected Behavior
I expected the command to run successfully, showing the outdated packages in my repository.
Steps To Reproduce
- Create a root package.json for an npm workspace, configuring the workspaces property correctly
- Add a local package named
admin-api-types for example
- Run
npm install to generate the package-lock.json
- Run
npm outdated: it works correctly up to now
Now, to introduce the bug:
5. Add a local package named api-types
6. Run npm install to update the package-lock.json
7. Run npm outdated: error
npm outdated
npm error code ENOVERSIONS
npm error No versions available for api-types
npm error A complete log of this run can be found in: /Users/kuteken/.npm/_logs/2026-08-07T15_26_06_628Z-debug-0.log
Opening the log, it shows these lines that caught my attention:
34 http fetch GET 404 https://registry.npmjs.org/admin-api-types 324ms (cache skip)
35 http fetch GET 200 https://registry.npmjs.org/api-types 328ms (cache miss)
36 verbose type range
37 verbose stack api-types: No versions available for api-types
37 verbose stack at pickManifest (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/node_modules/npm-pick-manifest/lib/index.js:141:25)
37 verbose stack at module.exports (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/node_modules/npm-pick-manifest/lib/index.js:188:16)
37 verbose stack at #getOutdatedInfo (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/commands/outdated.js:194:22)
37 verbose stack at async Promise.all (index 76)
37 verbose stack at async Outdated.exec (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/commands/outdated.js:76:5)
37 verbose stack at async Npm.exec (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/npm.js:193:9)
37 verbose stack at async module.exports (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/cli/entry.js:67:5)
To finish off, I ran two new commands:
$ npm view api-types versions
npm error code E404
npm error 404 Unpublished on 2020-09-27T15:31:17.123Z
npm error 404
npm error 404 The requested resource 'api-types' could not be found or you do not have permission to access it.
$ npm view admin-api-types versions
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/admin-api-types - Not found
npm error 404
npm error 404 The requested resource 'admin-api-types@*' could not be found or you do not have permission to access it.
api-types is a local workspace package, but it also matches a package that was previously published and later unpublished from the npm registry. npm outdated appears to query the registry anyway, receives metadata for the unpublished package, and eventually throws ENOVERSIONS instead of treating the dependency as a local workspace.
In summary, this suggests the following:
- Running
npm outdated fails when a local package coincides with an unpublished package in the npm public registry
I could reproduce it with another package named whatsapp-client, for example.
Environment
- npm: 12.0.2
- Node.js: v24.19.0
- OS Name: macOS 15.6
- System Model Name: Macbook Pro
- npm config:
; "user" config from /Users/kuteken/.npmrc
@indigohive:registry = "https://npm.pkg.github.com/"
//npm.pkg.github.com/:_authToken = (protected)
//registry.npmjs.org/:_authToken = (protected)
; node bin location = /Users/kuteken/.nvm/versions/node/v24.19.0/bin/node
; node version = v24.19.0
; npm local prefix = /Users/kuteken/git/indigohive/whatsapp
; npm version = 12.0.2
; cwd = /Users/kuteken/git/indigohive/whatsapp
; HOME = /Users/kuteken
; Run `npm config ls -l` to show all defaults.
Is there an existing issue for this?
This issue exists in the latest npm version
This is not just a request to bump a dependency for a CVE
Current Behavior
I ran the
npm outdatedscript on the root dir of an npm workspace.I have a local package named
api-types.I got this error:
Expected Behavior
I expected the command to run successfully, showing the outdated packages in my repository.
Steps To Reproduce
admin-api-typesfor examplenpm installto generate thepackage-lock.jsonnpm outdated: it works correctly up to nowNow, to introduce the bug:
5. Add a local package named
api-types6. Run
npm installto update thepackage-lock.json7. Run
npm outdated: errorOpening the log, it shows these lines that caught my attention:
To finish off, I ran two new commands:
api-typesis a local workspace package, but it also matches a package that was previously published and later unpublished from the npm registry. npm outdated appears to query the registry anyway, receives metadata for the unpublished package, and eventually throws ENOVERSIONS instead of treating the dependency as a local workspace.In summary, this suggests the following:
npm outdatedfails when a local package coincides with an unpublished package in the npm public registryI could reproduce it with another package named
whatsapp-client, for example.Environment