nodejs/node · error · Error

Package name must be specified either as an argument or in t

Error message

Package name must be specified either as an argument or in the package.json file

What it means

Thrown by `npm trust list` when no package name was given as the first positional argument AND the optional package.json in the current directory has no `name` field (or no package.json exists). The command needs a name to build the registry URI `/-/package/<escapedName>/trust`. optionalPkgJson swallows read errors and returns {}, so .name is undefined.

Source

Thrown at deps/npm/lib/commands/trust/list.js:38

    globalDefinitions.json,
    globalDefinitions.registry,
  ]

  static bodyToOptions (body) {
    if (body.type === 'circleci') {
      return TrustCircleCI.bodyToOptions(body)
    } else if (body.type === 'github') {
      return TrustGithub.bodyToOptions(body)
    } else if (body.type === 'gitlab') {
      return TrustGitlab.bodyToOptions(body)
    }
    return TrustCommand.bodyToOptions(body)
  }

  async exec (positionalArgs) {
    const packageName = positionalArgs[0] || (await this.optionalPkgJson()).name
    if (!packageName) {
      throw new Error('Package name must be specified either as an argument or in the package.json file')
    }
    const spec = npa(packageName)
    const uri = `/-/package/${spec.escapedName}/trust`
    const body = await otplease(this.npm, this.npm.flatOptions, opts => npmFetch.json(uri, {
      ...opts,
      method: 'GET',
    }))
    this.displayResponseBody({ body, packageName })
  }
}

module.exports = TrustList

View on GitHub (pinned to 1b2de5e052)

Solutions

Pass the package name explicitly: `npm trust list lodash`.
Add a `name` field to the local package.json and rerun.
Run the command from the package root that owns the package.json.

Example fix

// before
npm trust list
// after
npm trust list @my-scope/my-pkg

Defensive patterns

Strategy: validation

Validate before calling

const pkgName = positionalArg || (await readPkgJsonSafe()).name
if (!pkgName) {
  throw new Error('Package name must be supplied as the first argument or via package.json#name')
}
function readPkgJsonSafe() { try { return require('./package.json') } catch { return {} } }

Type guard

const hasUsableName = (positional, pkg) =>
  Boolean(positional) || Boolean(pkg && typeof pkg.name === 'string' && pkg.name.length)

Try / catch

try {
  await trustList.exec([maybePkg])
} catch (err) {
  if (/Package name must be specified/i.test(err.message)) {
    // fall back to an explicit package argument and retry
  } else { throw err }
}

Prevention

Always pass an explicit package name when scripting `npm trust list`.
Ensure the local package.json has a `name` field before relying on it.
Run trust commands from the package root.

When it happens

Trigger: Running `npm trust list` in an empty dir, a scratch dir without package.json, or a package.json missing the `name` field. Also when the package.json is malformed enough that normalize yields no name.

Common situations: Exploring trust features outside a project; running from a config-only directory; a monorepo child that has dependencies but no name set yet.

Related errors

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/365089fc88c5e479. Report an issue: GitHub.