nodejs/node · error · Error

Package name must be specified either as an argument or in…

Error message

Package name must be specified either as an argument or in the package.json file

What it means

Thrown by `npm trust list` when no package name was given as the first positional argument AND the optional package.json in the current directory has no `name` field (or no package.json exists). The command needs a name to build the registry URI `/-/package/<escapedName>/trust`. optionalPkgJson swallows read errors and returns {}, so .name is undefined.

Solutions

Pass the package name explicitly: `npm trust list lodash`.
Add a `name` field to the local package.json and rerun.
Run the command from the package root that owns the package.json.

Example fix

// before
npm trust list
// after
npm trust list @my-scope/my-pkg

Defensive patterns

Strategy: validation

Validate before calling

const pkgName = positionalArg || (await readPkgJsonSafe()).name
if (!pkgName) {
  throw new Error('Package name must be supplied as the first argument or via package.json#name')
}
function readPkgJsonSafe() { try { return require('./package.json') } catch { return {} } }

Type guard

const hasUsableName = (positional, pkg) =>
  Boolean(positional) || Boolean(pkg && typeof pkg.name === 'string' && pkg.name.length)

Try / catch

try {
  await trustList.exec([maybePkg])
} catch (err) {
  if (/Package name must be specified/i.test(err.message)) {
    // fall back to an explicit package argument and retry
  } else { throw err }
}

Prevention

Always pass an explicit package name when scripting `npm trust list`.
Ensure the local package.json has a `name` field before relying on it.
Run trust commands from the package root.

When it happens

Trigger: Running `npm trust list` in an empty dir, a scratch dir without package.json, or a package.json missing the `name` field. Also when the package.json is malformed enough that normalize yields no name.

Common situations: Exploring trust features outside a project; running from a config-only directory; a monorepo child that has dependencies but no name set yet.

Related errors

AI-assisted analysis of nodejs/node@1b2de5e052 (2026-08-13). Data as JSON: /api/errors/365089fc88c5e479. Report an issue: GitHub.

Appendix: source

Thrown at deps/npm/lib/commands/trust/list.js:38

    globalDefinitions.json,
    globalDefinitions.registry,
  ]

  static bodyToOptions (body) {
    if (body.type === 'circleci') {
      return TrustCircleCI.bodyToOptions(body)
    } else if (body.type === 'github') {
      return TrustGithub.bodyToOptions(body)
    } else if (body.type === 'gitlab') {
      return TrustGitlab.bodyToOptions(body)
    }
    return TrustCommand.bodyToOptions(body)
  }

  async exec (positionalArgs) {
    const packageName = positionalArgs[0] || (await this.optionalPkgJson()).name
    if (!packageName) {
      throw new Error('Package name must be specified either as an argument or in the package.json file')
    }
    const spec = npa(packageName)
    const uri = `/-/package/${spec.escapedName}/trust`
    const body = await otplease(this.npm, this.npm.flatOptions, opts => npmFetch.json(uri, {
      ...opts,
      method: 'GET',
    }))
    this.displayResponseBody({ body, packageName })
  }
}

module.exports = TrustList

View on GitHub (pinned to 1b2de5e052)