oven-sh/bun · error · bun_install::Error

TarballHTTP401

Error message

TarballHTTP401

What it means

The registry answered the tarball request with 401 Unauthorized: bun sent no token, or an invalid/expired one, to a registry that requires authentication. The install of that package halts with TarballHTTP401.

Source

Thrown at src/install/error.rs:21

    #[error("FileNotFound")]
    FileNotFound,
    #[error("AccessDenied")]
    AccessDenied,
    #[error("NotDir")]
    NotDir,
    #[error("NameTooLong")]
    NameTooLong,
    #[error("SymLinkLoop")]
    SymLinkLoop,
    #[error("SystemFdQuotaExceeded")]
    SystemFdQuotaExceeded,
    #[error("SystemResources")]
    SystemResources,
    #[error("DeviceBusy")]
    DeviceBusy,
    #[error("TarballHTTP400")]
    TarballHTTP400,
    #[error("TarballHTTP401")]
    TarballHTTP401,
    #[error("TarballHTTP402")]
    TarballHTTP402,
    #[error("TarballHTTP403")]
    TarballHTTP403,
    #[error("TarballHTTP404")]
    TarballHTTP404,
    #[error("TarballHTTP4xx")]
    TarballHTTP4xx,
    #[error("TarballHTTP5xx")]
    TarballHTTP5xx,
    #[error("TarballFailedToExtract")]
    TarballFailedToExtract,
    #[error("TarballFailedToDownload")]
    TarballFailedToDownload,
    #[error("BadRequest")]
    BadRequest,
    #[error("TooManyRequests")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Refresh the token: log in again or update the CI secret
2. Ensure .npmrc carries //registry.npmjs.org/:_authToken=${NPM_TOKEN} (plus per-scope entries)
3. Verify the token: curl -H "Authorization: Bearer $NPM_TOKEN" https://registry.npmjs.org/-/whoami
4. Confirm the CI step actually exports the token env var

Example fix

# before (.npmrc)
//registry.npmjs.org/:_authToken=${NPM_TOKEN}   # token expired

# after
# rotate the token in registry settings, update the CI secret, then
curl -H "Authorization: Bearer $NPM_TOKEN" https://registry.npmjs.org/-/whoami
bun install

const token = process.env.NPM_TOKEN;
if (!token) { console.error("NPM_TOKEN missing"); process.exit(1); }
const res = await fetch("https://registry.npmjs.org/-/whoami", {
  headers: { Authorization: `Bearer ${token}` },
});
if (res.status === 401) { console.error("token invalid or expired"); process.exit(1); }

When it happens

Trigger: Fetching a private package (or from a private registry) with a missing, expired, or malformed token from .npmrc / CI secrets; an authToken line that references an unset env var; the default registry switched to an authenticating proxy.

Common situations: Rotated NPM_TOKEN not updated in CI secrets; expired npm login; missing //registry.npmjs.org/:_authToken line; env vars not passed to the bun install step.

Related errors

• TarballHTTP403
• not called
• TarballHTTP402
• TarballHTTP404
• page-cache eviction failed for ${path}; results would be war

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/776ceb180fe29f0e. Report an issue: GitHub.