oven-sh/bun · error · bun_install::Error

TarballHTTP402

Error message

TarballHTTP402

What it means

The registry returned 402 Payment Required for the tarball. npm uses this for private packages when the owning org's billing or seat situation denies access even with a valid token — the registry refuses to serve the artifact on the current plan.

Source

Thrown at src/install/error.rs:23

    #[error("AccessDenied")]
    AccessDenied,
    #[error("NotDir")]
    NotDir,
    #[error("NameTooLong")]
    NameTooLong,
    #[error("SymLinkLoop")]
    SymLinkLoop,
    #[error("SystemFdQuotaExceeded")]
    SystemFdQuotaExceeded,
    #[error("SystemResources")]
    SystemResources,
    #[error("DeviceBusy")]
    DeviceBusy,
    #[error("TarballHTTP400")]
    TarballHTTP400,
    #[error("TarballHTTP401")]
    TarballHTTP401,
    #[error("TarballHTTP402")]
    TarballHTTP402,
    #[error("TarballHTTP403")]
    TarballHTTP403,
    #[error("TarballHTTP404")]
    TarballHTTP404,
    #[error("TarballHTTP4xx")]
    TarballHTTP4xx,
    #[error("TarballHTTP5xx")]
    TarballHTTP5xx,
    #[error("TarballFailedToExtract")]
    TarballFailedToExtract,
    #[error("TarballFailedToDownload")]
    TarballFailedToDownload,
    #[error("BadRequest")]
    BadRequest,
    #[error("TooManyRequests")]
    TooManyRequests,
    #[error("HTTPInternalServerError")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Fix the org's billing/seats in the npm account settings
2. Confirm the token's user still has access to the package's org
3. Publish the package to a self-hosted registry you control for guaranteed availability
4. As a stopgap, vendor the package or pin a public equivalent

Example fix

# before
bun add @corp/private-pkg   # org seat lapsed -> TarballHTTP402

# after
# restore the seat in npm org settings, then
bun add @corp/private-pkg

const res = await fetch(tarballUrl, { headers: { Authorization: `Bearer ${process.env.NPM_TOKEN}` } });
if (res.status === 402) {
  console.error("registry demands payment for this artifact; check org billing/seats");
  process.exit(1);
}

const p = Bun.spawnSync(["bun", "install"]);
if (p.stderr.toString().includes("TarballHTTP402")) {
  // fall back to the self-hosted mirror that serves the same package
  await Bun.write(".npmrc", "@corp:registry=https://npm.corp.internal\n");
  Bun.spawnSync(["bun", "install"]);
}

When it happens

Trigger: Installing a private npm package after the org's paid plan lapsed, the seat was removed, or the token's user was dropped from the org; some proxies also use 402 for quota-style denials.

Common situations: Org billing card expired; license seats reallocated; a teammate's token still referencing a package the org no longer pays for.

Related errors

• TarballHTTP401
• TarballHTTP403
• TarballHTTP404
• page-cache eviction failed for ${path}; results would be war
• not called

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/19f4c4f5d6baecec. Report an issue: GitHub.