oven-sh/bun · error · bun_install::Error

TarballHTTP404

Error message

TarballHTTP404

What it means

The tarball URL returned 404: the registry has no tarball at the URL bun used. Typical causes: the package or version was unpublished, the lockfile pins a version whose artifact no longer exists, a typo'd dependency name, or a mirror lacking the package.

Source

Thrown at src/install/error.rs:27

    #[error("NameTooLong")]
    NameTooLong,
    #[error("SymLinkLoop")]
    SymLinkLoop,
    #[error("SystemFdQuotaExceeded")]
    SystemFdQuotaExceeded,
    #[error("SystemResources")]
    SystemResources,
    #[error("DeviceBusy")]
    DeviceBusy,
    #[error("TarballHTTP400")]
    TarballHTTP400,
    #[error("TarballHTTP401")]
    TarballHTTP401,
    #[error("TarballHTTP402")]
    TarballHTTP402,
    #[error("TarballHTTP403")]
    TarballHTTP403,
    #[error("TarballHTTP404")]
    TarballHTTP404,
    #[error("TarballHTTP4xx")]
    TarballHTTP4xx,
    #[error("TarballHTTP5xx")]
    TarballHTTP5xx,
    #[error("TarballFailedToExtract")]
    TarballFailedToExtract,
    #[error("TarballFailedToDownload")]
    TarballFailedToDownload,
    #[error("BadRequest")]
    BadRequest,
    #[error("TooManyRequests")]
    TooManyRequests,
    #[error("HTTPInternalServerError")]
    HTTPInternalServerError,
    #[error("UnexpectedNotModified")]
    UnexpectedNotModified,
    #[error("PackageFailedToParse")]

View on GitHub (pinned to 8c5296ac45)

Solutions

1. Confirm the package/version exists: npm view <pkg>@<version> or open the registry URL
2. Update or re-pin the dependency to an existing version and regenerate the lockfile
3. If using a mirror/proxy, sync it or bypass it for that scope
4. Diff package.json names against the real package on the registry to catch typos

Example fix

// before
"dependencies": { "lodahs": "^4.17.21" }  // typo
// after
"dependencies": { "lodash": "^4.17.21" }

# then regenerate resolutions
rm bun.lock && bun install

import pkg from "./package.json";
const deps = { ...pkg.dependencies, ...pkg.devDependencies };
for (const [name] of Object.entries(deps)) {
  const registryName = name.startsWith("@") ? name : encodeURIComponent(name);
  const res = await fetch(`https://registry.npmjs.org/${registryName}`);
  if (res.status === 404) { console.error("unknown package:", name); process.exit(1); }
}

When it happens

Trigger: `bun install` with a lockfile entry for a version the registry removed; dependency name typo in package.json; registry mirror or proxy cache missing the artifact; scoped package resolved against the wrong registry host.

Common situations: Author unpublished a version; lockfile committed from a different registry; internal proxy not yet replicated a freshly published version; name typos and case errors.

Related errors

• TarballHTTP401
• TarballHTTP402
• TarballHTTP403
• page-cache eviction failed for ${path}; results would be war
• not called

AI-assisted analysis of oven-sh/bun@8c5296ac45 (2026-08-16). Data as JSON: /api/errors/005bdc0e45a175cc. Report an issue: GitHub.