{"record":{"id":"d45d2bd17cf49119","repo":"cube-js/cube","slug":"package-packagepath-not-found","errorCode":null,"errorMessage":"Package '${packagePath}' not found","messagePattern":"Package '(.+?)' not found","errorType":"exception","errorClass":"UserError","httpStatus":null,"severity":"error","filePath":"packages/cubejs-schema-compiler/src/compiler/DataSchemaCompiler.ts","lineNumber":1016,"sourceCode":"\n    if (!absPath.startsWith(nodeModulesPath)) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`'${modulePath}' restricted`);\n    }\n    const packagePath = absPath.replace(nodeModulesPath, '').split('/').filter(s => !!s)[0];\n    if (!packagePath) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`'${modulePath}' is incorrect`);\n    }\n    if (!this.isWhiteListedPackage(packagePath)) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      throw new UserError(`Package '${packagePath}' not found`);\n    }\n    if (fs.existsSync(absPath)) {\n      const stat = fs.lstatSync(absPath);\n      if (stat.isDirectory()) {\n        absPath = path.resolve(absPath, 'index.js');\n      }\n    }\n    // eslint-disable-next-line prefer-template\n    absPath = path.extname(absPath) !== '.js' ? absPath + '.js' : absPath;\n    if (!fs.existsSync(absPath)) {\n      if (this.allowNodeRequire) {\n        return null;\n      }\n      // eslint-disable-next-line prefer-template\n      throw new UserError(`Path '${absPath.replace(nodeModulesPath + '/', '')}' not found`);\n    }\n    return this.readModuleFile(absPath, errorsReport);\n  }","sourceCodeStart":998,"sourceCodeEnd":1034,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-schema-compiler/src/compiler/DataSchemaCompiler.ts#L998-L1034","documentation":"The compiler only allows importing packages that pass isWhiteListedPackage. When the top-level package of the import is not whitelisted and allowNodeRequire is false, it throws UserError 'Package '${packagePath}' not found' — a deliberately generic message so attackers cannot probe which packages exist.","triggerScenarios":"require/import of an npm package from a JS data model where the package name is not in the compiler's whitelist (or the configured package whitelist option) and allowNodeRequire is not enabled.","commonSituations":"Adding a new dependency to schemas without registering it, deploying to Cube Cloud where non-whitelisted requires are blocked, or typos in package names.","solutions":["Install the package in node_modules and add it to the compiler's allowed/whitelisted packages configuration","Check the package name for typos and casing","Enable allowNodeRequire if your environment permits unrestricted Node requires","Replace the dependency with logic implementable inside the data model itself"],"exampleFix":"// before\nimport { z } from 'zod'; // not whitelisted\n\n// after (compilerOptions)\n{ allowNodeRequire: true }\n// or whitelist 'zod' in the compiler package whitelist option","handlingStrategy":"validation","validationCode":"const allowed = new Set(['lodash', 'moment']);\nfunction assertWhitelisted(packagePath) {\n  if (!allowed.has(packagePath)) throw new Error(`Package '${packagePath}' must be whitelisted before import`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await compiler.compile();\n} catch (e) {\n  const m = String(e.message).match(/Package '(.+)' not found/);\n  if (m) console.error(`Whitelist package '${m[1]}' or enable allowNodeRequire`);\n}","preventionTips":["Maintain an explicit list of schema dependencies and keep it synced with package.json","Test schema compilation in CI before deploying","Only import packages present in node_modules of the deployment image"],"tags":["security","whitelist","module-resolution","schema-compiler"],"backgroundTag":"package-not-whitelisted","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}