Budibase/budibase · error · Error
NPM Package not found
Error message
NPM Package not found
What it means
Thrown when the registry lookup for the NPM package (https://registry.npmjs.org/<name>) returns a status other than 200, meaning the package name extracted from the URL does not resolve on the public NPM registry.
Source
Thrown at packages/server/src/api/controllers/plugin/npm.ts:48
let pluginName = name
const parsedInput = parseNpmUrl(npmTarballUrl)
if (!isAllowedNpmHost(parsedInput.hostname)) {
throw new Error("The plugin origin must be from NPM")
}
if (!npmTarballUrl.includes(".tgz")) {
if (
parsedInput.hostname !== "www.npmjs.com" ||
!parsedInput.pathname.startsWith("/package/")
) {
throw new Error("The plugin origin must be from NPM")
}
const packageName = parsedInput.pathname.replace("/package/", "").trim()
const npmPackageURl = `https://registry.npmjs.org/${packageName}`
const response = await coreUtils.fetchWithBlacklist(npmPackageURl)
if (response.status !== 200) {
throw new Error("NPM Package not found")
}
let npmDetails = await response.json()
pluginName = npmDetails.name
const npmVersion = npmDetails["dist-tags"].latest
npmTarballUrl = npmDetails?.versions?.[npmVersion]?.dist?.tarball
if (!npmTarballUrl) {
throw new Error("NPM tarball url not found")
}
}
const path = await downloadUnzipTarball(npmTarballUrl, pluginName, headers)
const pluginRoot = join(path, "package", "dist")
try {
return await getPluginMetadata(pluginRoot, path)
} catch (err) {
deleteFolderFileSystem(path)View on GitHub (pinned to a81a902e9a)
Solutions
- Verify the package exists: curl https://registry.npmjs.org/<packageName>
- Check the package was not unpublished or renamed
- Confirm network/proxy access to registry.npmjs.org from the server
- Publish the plugin package to NPM if it is new
Defensive patterns
Strategy: validation
Validate before calling
const res = await fetch(`https://registry.npmjs.org/${packageName}`)
if (res.status !== 200) throw new Error(`Package ${packageName} not found on NPM registry`) Try / catch
try {
await npmUpload({ input })
} catch (err) {
if (err.message === 'NPM Package not found') {
// verify package name on https://registry.npmjs.org before retrying
}
} Prevention
- Check the package exists on npmjs.com before uploading its page URL
- Confirm the package is not unpublished/private
- Test registry reachability from the server (proxy/firewall)
When it happens
Trigger: Uploading a plugin via a www.npmjs.com/package/<name> URL where <name> does not exist on the registry, was unpublished, or is private/unscoped incorrectly encoded; also registry outages returning non-200.
Common situations: Typos in package name; package unpublished or renamed; scoped private packages not on public registry; corporate proxy blocking registry.npmjs.org so fetch fails with non-200.
Related errors
- NPM tarball url not found
- npm is required to run this project (package-lock.json or pa
- Error getting account by tenantId ${tenantId}
- ${err.message}
- Unexpected response when fetching openid-configuration: ${re
AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29).
Data as JSON: /api/errors/2bd79b6225de3580.
Report an issue: GitHub.