What causes "Package '${packagePath}' not found" in cube-js/cube?

Install the package in node_modules and add it to the compiler's allowed/whitelisted packages configuration

cube-js/cube · error · UserError

Package '${packagePath}' not found

Error message

Package '${packagePath}' not found

What it means

The compiler only allows importing packages that pass isWhiteListedPackage. When the top-level package of the import is not whitelisted and allowNodeRequire is false, it throws UserError 'Package '${packagePath}' not found' — a deliberately generic message so attackers cannot probe which packages exist.

Source

Thrown at packages/cubejs-schema-compiler/src/compiler/DataSchemaCompiler.ts:1016

    if (!absPath.startsWith(nodeModulesPath)) {
      if (this.allowNodeRequire) {
        return null;
      }
      throw new UserError(`'${modulePath}' restricted`);
    }
    const packagePath = absPath.replace(nodeModulesPath, '').split('/').filter(s => !!s)[0];
    if (!packagePath) {
      if (this.allowNodeRequire) {
        return null;
      }
      throw new UserError(`'${modulePath}' is incorrect`);
    }
    if (!this.isWhiteListedPackage(packagePath)) {
      if (this.allowNodeRequire) {
        return null;
      }
      throw new UserError(`Package '${packagePath}' not found`);
    }
    if (fs.existsSync(absPath)) {
      const stat = fs.lstatSync(absPath);
      if (stat.isDirectory()) {
        absPath = path.resolve(absPath, 'index.js');
      }
    }
    // eslint-disable-next-line prefer-template
    absPath = path.extname(absPath) !== '.js' ? absPath + '.js' : absPath;
    if (!fs.existsSync(absPath)) {
      if (this.allowNodeRequire) {
        return null;
      }
      // eslint-disable-next-line prefer-template
      throw new UserError(`Path '${absPath.replace(nodeModulesPath + '/', '')}' not found`);
    }
    return this.readModuleFile(absPath, errorsReport);
  }

View on GitHub (pinned to 7d981676b3)

Solutions

Install the package in node_modules and add it to the compiler's allowed/whitelisted packages configuration
Check the package name for typos and casing
Enable allowNodeRequire if your environment permits unrestricted Node requires
Replace the dependency with logic implementable inside the data model itself

Example fix

// before
import { z } from 'zod'; // not whitelisted

// after (compilerOptions)
{ allowNodeRequire: true }
// or whitelist 'zod' in the compiler package whitelist option

Defensive patterns

Strategy: validation

Validate before calling

const allowed = new Set(['lodash', 'moment']);
function assertWhitelisted(packagePath) {
  if (!allowed.has(packagePath)) throw new Error(`Package '${packagePath}' must be whitelisted before import`);
}

Try / catch

try {
  await compiler.compile();
} catch (e) {
  const m = String(e.message).match(/Package '(.+)' not found/);
  if (m) console.error(`Whitelist package '${m[1]}' or enable allowNodeRequire`);
}

Prevention

Maintain an explicit list of schema dependencies and keep it synced with package.json
Test schema compilation in CI before deploying
Only import packages present in node_modules of the deployment image

When it happens

Trigger: require/import of an npm package from a JS data model where the package name is not in the compiler's whitelist (or the configured package whitelist option) and allowNodeRequire is not enabled.

Common situations: Adding a new dependency to schemas without registering it, deploying to Cube Cloud where non-whitelisted requires are blocked, or typos in package names.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/d45d2bd17cf49119. Report an issue: GitHub.