{"record":{"id":"776ceb180fe29f0e","repo":"oven-sh/bun","slug":"tarballhttp401","errorCode":null,"errorMessage":"TarballHTTP401","messagePattern":"TarballHTTP401","errorType":"error_code","errorClass":"bun_install::Error","httpStatus":401,"severity":"error","filePath":"src/install/error.rs","lineNumber":21,"sourceCode":"    #[error(\"FileNotFound\")]\n    FileNotFound,\n    #[error(\"AccessDenied\")]\n    AccessDenied,\n    #[error(\"NotDir\")]\n    NotDir,\n    #[error(\"NameTooLong\")]\n    NameTooLong,\n    #[error(\"SymLinkLoop\")]\n    SymLinkLoop,\n    #[error(\"SystemFdQuotaExceeded\")]\n    SystemFdQuotaExceeded,\n    #[error(\"SystemResources\")]\n    SystemResources,\n    #[error(\"DeviceBusy\")]\n    DeviceBusy,\n    #[error(\"TarballHTTP400\")]\n    TarballHTTP400,\n    #[error(\"TarballHTTP401\")]\n    TarballHTTP401,\n    #[error(\"TarballHTTP402\")]\n    TarballHTTP402,\n    #[error(\"TarballHTTP403\")]\n    TarballHTTP403,\n    #[error(\"TarballHTTP404\")]\n    TarballHTTP404,\n    #[error(\"TarballHTTP4xx\")]\n    TarballHTTP4xx,\n    #[error(\"TarballHTTP5xx\")]\n    TarballHTTP5xx,\n    #[error(\"TarballFailedToExtract\")]\n    TarballFailedToExtract,\n    #[error(\"TarballFailedToDownload\")]\n    TarballFailedToDownload,\n    #[error(\"BadRequest\")]\n    BadRequest,\n    #[error(\"TooManyRequests\")]","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/src/install/error.rs#L3-L39","documentation":"The registry answered the tarball request with 401 Unauthorized: bun sent no token, or an invalid/expired one, to a registry that requires authentication. The install of that package halts with TarballHTTP401.","triggerScenarios":"Fetching a private package (or from a private registry) with a missing, expired, or malformed token from .npmrc / CI secrets; an authToken line that references an unset env var; the default registry switched to an authenticating proxy.","commonSituations":"Rotated NPM_TOKEN not updated in CI secrets; expired npm login; missing //registry.npmjs.org/:_authToken line; env vars not passed to the bun install step.","solutions":["Refresh the token: log in again or update the CI secret","Ensure .npmrc carries //registry.npmjs.org/:_authToken=${NPM_TOKEN} (plus per-scope entries)","Verify the token: curl -H \"Authorization: Bearer $NPM_TOKEN\" https://registry.npmjs.org/-/whoami","Confirm the CI step actually exports the token env var"],"exampleFix":"# before (.npmrc)\n//registry.npmjs.org/:_authToken=${NPM_TOKEN}   # token expired\n\n# after\n# rotate the token in registry settings, update the CI secret, then\ncurl -H \"Authorization: Bearer $NPM_TOKEN\" https://registry.npmjs.org/-/whoami\nbun install","handlingStrategy":"validation","validationCode":"const token = process.env.NPM_TOKEN;\nif (!token) { console.error(\"NPM_TOKEN missing\"); process.exit(1); }\nconst res = await fetch(\"https://registry.npmjs.org/-/whoami\", {\n  headers: { Authorization: `Bearer ${token}` },\n});\nif (res.status === 401) { console.error(\"token invalid or expired\"); process.exit(1); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add a whoami preflight step in CI before bun install","Rotate tokens on a schedule and update secrets atomically","Keep per-scope .npmrc entries next to the lockfile"],"tags":["install","network","auth","registry","http-401"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}