Budibase/budibase · error · Error

NPM tarball url not found

Error message

NPM tarball url not found

What it means

Thrown when NPM registry metadata was fetched but no tarball URL could be derived from dist-tags.latest -> versions[latest].dist.tarball, so there is nothing to download.

Source

Thrown at packages/server/src/api/controllers/plugin/npm.ts:57

      parsedInput.hostname !== "www.npmjs.com" ||
      !parsedInput.pathname.startsWith("/package/")
    ) {
      throw new Error("The plugin origin must be from NPM")
    }
    const packageName = parsedInput.pathname.replace("/package/", "").trim()
    const npmPackageURl = `https://registry.npmjs.org/${packageName}`
    const response = await coreUtils.fetchWithBlacklist(npmPackageURl)
    if (response.status !== 200) {
      throw new Error("NPM Package not found")
    }

    let npmDetails = await response.json()
    pluginName = npmDetails.name
    const npmVersion = npmDetails["dist-tags"].latest
    npmTarballUrl = npmDetails?.versions?.[npmVersion]?.dist?.tarball

    if (!npmTarballUrl) {
      throw new Error("NPM tarball url not found")
    }
  }

  const path = await downloadUnzipTarball(npmTarballUrl, pluginName, headers)
  const pluginRoot = join(path, "package", "dist")
  try {
    return await getPluginMetadata(pluginRoot, path)
  } catch (err) {
    deleteFolderFileSystem(path)
    throw err
  }
}

View on GitHub (pinned to a81a902e9a)

Solutions

1. Confirm the package has at least one published version and a valid 'latest' dist-tag
2. Check registry response: curl https://registry.npmjs.org/<pkg> | jq '."dist-tags", .versions[."dist-tags".latest].dist.tarball'
3. Ensure no proxy/mirror is stripping fields from the registry response
4. Retry if the registry returned a transient partial response

const meta = await (await fetch(`https://registry.npmjs.org/${packageName}`)).json()
const latest = meta['dist-tags']?.latest
if (!meta?.versions?.[latest]?.dist?.tarball) throw new Error('Registry metadata has no tarball for latest version')

function hasTarball(meta: unknown): meta is { name: string; 'dist-tags': { latest: string }; versions: Record<string, { dist: { tarball: string } }> } {
  const m = meta as any
  return !!m?.['dist-tags']?.latest && !!m?.versions?.[m['dist-tags'].latest]?.dist?.tarball
}

try {
  await npmUpload({ input })
} catch (err) {
  if (err.message === 'NPM tarball url not found') {
    // inspect registry metadata / retry — likely a mirror or API response issue
  }
}

When it happens

Trigger: The registry response lacks a 'dist-tags' latest entry, the latest version object has no dist.tarball, or the response shape is unexpected (e.g. a deprecation/mirror response).

Common situations: Malformed or proxied registry responses; packages with no published versions; NPM registry API changes; a mirror returning partial metadata.

Related errors

• NPM Package not found
• npm is required to run this project (package-lock.json or pa
• Error getting account by tenantId ${tenantId}
• ${err.message}
• Unexpected response when fetching openid-configuration: ${re

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/86fde53b7e8d2b1e. Report an issue: GitHub.