[BUG] EINVALIDPACKAGENAME on npm update -g

[lmoustak]

Current Behavior:

Running

npm update -g

without specifying any package - i.e. update all global packages, throws this error:

npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name ".bin": name cannot start with a period

Specifying package(s) will update these packages with no problems.

Expected Behavior:

npm updates all global packages normally.

Steps To Reproduce:

run npm update -g in a terminal (either command prompt or powershell)

Environment:

• OS: Windows 10 19042.844
• Node: v14.16.0
• NPM: v7.6.1

[ljharb]

What does npm ls -g --depth=1 print out?

[ljharb]

(separately, npm update -g should be erroring out, since it doesn’t make sense to update a package.json that doesn’t exist)

[lmoustak]

C:\Users\<username>\AppData\Roaming\npm
+-- [email protected]
| +-- @npmcli/[email protected]
| +-- @npmcli/[email protected]
| +-- @npmcli/[email protected]
| +-- @npmcli/[email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| +-- [email protected]
| `-- [email protected]
`-- [email protected]

I thought npm update -g didn't need a package.json.

[stradicat]

With previous versions of npm, one could update system-wide node packages, such as those needed by some editors like Emacs. Running sudo npm upgrade -g worked for that purpose. Something seems to have changed, however.

[lmoustak]

Just checked the

C:\Users\<username>\AppData\Roaming\npm\node_modules

directory. There was a .bin folder which was a copy of npm\bin, and a .package-lock.json.

npm update -g apparently scanned that directory and threw an error when it found something with a period as the first character. I moved the offending file and directory into the Recycle Bin and it works now.

[bachandi]

Have the same problem running global update without package:

$ npm update -g
npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name ".bin": name cannot start with a period

npm ERR! A complete log of this run can be found in:
npm ERR!     /root/.npm/_logs/2021-03-09T14_54_18_480Z-debug.log

With the log output:

$ cat /root/.npm/_logs/2021-03-09T14_54_18_480Z-debug.log
0 verbose cli [ '/usr/local/bin/node', '/usr/local/bin/npm', 'update', '-g' ]
1 info using [email protected]
2 info using [email protected]
3 timing config:load:defaults Completed in 8ms
4 timing config:load:file:/usr/local/lib/node_modules/npm/npmrc Completed in 6ms
5 timing config:load:builtin Completed in 6ms
6 timing config:load:cli Completed in 12ms
7 timing config:load:env Completed in 1ms
8 timing config:load:file:/home/user/.npmrc Completed in 1ms
9 timing config:load:project Completed in 4ms
10 timing config:load:file:/root/.npmrc Completed in 0ms
11 timing config:load:user Completed in 1ms
12 timing config:load:file:/usr/local/etc/npmrc Completed in 0ms
13 timing config:load:global Completed in 1ms
14 timing config:load:cafile Completed in 1ms
15 timing config:load:validate Completed in 1ms
16 timing config:load:setUserAgent Completed in 2ms
17 timing config:load:setEnvs Completed in 4ms
18 timing config:load Completed in 42ms
19 verbose npm-session 47b879a6ca19f9d4
20 timing npm:load Completed in 74ms
21 timing arborist:ctor Completed in 3ms
22 timing idealTree:init Completed in 31ms
23 timing idealTree:userRequests Completed in 10ms
24 silly idealTree buildDeps
25 timing idealTree Completed in 53ms
26 timing command:update Completed in 90ms
27 verbose stack Error: Invalid package name ".bin": name cannot start with a period
27 verbose stack     at invalidPackageName (/usr/local/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:89:15)
27 verbose stack     at Result.setName (/usr/local/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:124:11)
27 verbose stack     at new Result (/usr/local/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:114:23)
27 verbose stack     at Function.resolve (/usr/local/lib/node_modules/npm/node_modules/npm-package-arg/npa.js:61:15)
27 verbose stack     at Arborist.[nodeFromEdge] (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:887:22)
27 verbose stack     at Arborist.[buildDepStep] (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:836:36)
27 verbose stack     at Arborist.[buildDeps] (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:691:31)
27 verbose stack     at Arborist.buildIdealTree (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:209:29)
27 verbose stack     at processTicksAndRejections (internal/process/task_queues.js:93:5)
27 verbose stack     at async Arborist.reify (/usr/local/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:130:5)
28 verbose cwd /home/user
29 verbose Linux 5.10.17-v7+
30 verbose argv "/usr/local/bin/node" "/usr/local/bin/npm" "update" "-g"
31 verbose node v14.16.0
32 verbose npm  v7.6.1
33 error code EINVALIDPACKAGENAME
34 error Invalid package name ".bin": name cannot start with a period
35 verbose exit 1

/usr/local/lib/node_modules/npm/node_modules has a .bin folder but this is not the culprit as moving is didn't help. From the log file I couldn't figure out which .bin folder is bugging him. Any ideas?

[stradicat]

Well, I had forgotten to do something a bit simple yet revealing:

ls /usr/lib/node_modules/ -lha

Many .module_name packages, probably left over from an aborted installation. I rm -rf'ed each of them, ran sudo npm upgrade -g again, and no errors were shown.

[bachandi]

Thanks for the push. There where was /usr/local/lib/node_modules/.bin with its content also in /usr/local/bin. Now after removing /usr/local/lib/node_modules/.bin the upgrade via npm upgrade -g works again.

[sparanoid]

Also got this error when upgrade an old server from 8 to 16. The .bin is located at /usr/lib/node_modules/.bin. Node.js was installed with nodesource.

[dustypomerleau]

I am experiencing a very similar error with system-generated .DS_Store files on macOS:

npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name ".DS_Store": name cannot start with a period

Manually deleting the .DS_Store file will allow an update, but the solution doesn't persist (the .DS_Store file is inevitably re-created).

[nhhockeyplayer]

who is going to get their act together here

when XWindows was deployed by MIT it was bulletproof free and open source those days are long gone by everyone that wants to be famous

you cant just break every project on the planet

nothing is patched and its been months wiping out all builds

this is widespread

upgrading to latest npm fails deleting and reinstalling node.js fails cleaning up all node_module caches fails npm cache clean --force fails and to what extent has this contaminated packages released and deployed

[itsmelion]

I see someone tagged Windows. but its happening to me in MacOS 12.

[countzyx]

Can't NPM just be changed to ignore these folders rather than complain about them?

[lucknaumann]

I just had this with a .package-lock.json file. As @lmoustak mentioned, I went into C:\Users\USERNAME\AppData\Roaming\npm\node_modules and deleted the offending file. Now it works.

npm update -g
npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name ".package-lock.json": name cannot start with a period

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\Users\USERNAME\AppData\Local\npm-cache\_logs\2021-11-16T19_26_47_811Z-debug.log

Edit: Edition: Windows 10 Home Version: 21H1 OS build: 19043.1348

[ds-cbo]

For reference, I got the following:

% npm update -g
npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name ".npm-uqSPdfFS": name cannot start with a period

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/$USER/.npm/_logs/2021-12-10T14_28_14_153Z-debug.log

And after searching for this .npm-uqSPdfFS directory for way too long, I eventually found it in:

/opt/homebrew/lib/node_modules/.npm-uqSPdfFS

Deleting it resolved the issue, but I have no clue when or how it was created.

Versions etc

% which npm
/opt/homebrew/bin/npm
% npm --version
8.3.0

% which node
/opt/homebrew/bin/node
% node --version
v17.2.0

% brew --version
Homebrew 3.3.7
Homebrew/homebrew-core (git revision 1df817931da; last commit 2021-12-10)
Homebrew/homebrew-cask (git revision 480330b60a; last commit 2021-12-10)

% brew --prefix
/opt/homebrew

% uname -srmo
Darwin 21.1.0 arm64 Darwin

[profhun]

Hi!

We have a similar problem. Our team uses lerna + renovate and during the package-lock.json generation we get this error:

lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only stderr:
...
npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name "graphql-tools/utils": name can only contain URL-friendly characters

versions:

npm -v
8.3.2
node -v
v14.17.5

[michaelchadwick]

In case anyone is using macOS and nvm to manage their node versions, I had to look in the ~/.nvm/versions/node/[current-version]/lib/node_modules for the offending file(s). Still not sure how the .DS_Store files got in there, unless I navigated to it at some point in Finder?

[itsmelion]

You or... something. ~(the X-Files soundtrack)

[aheckler]

If you're using n, you can try:

$ cd .n
$ find . -name ".DS_Store" -delete

This has worked for me. YMMV.

[ray007]

Looking around I found I had a directory C:\Users\<username>\AppData\Roaming\npm\node_modules\.bin. Removing this .bin directory (and a file .package-lock.json in the same directory), the update call without package name now works as intended.

[MarekBartczak]

for me works when I removed (MAC ONLY!!)

/usr/local/lib/node_modules

by

sudo rm -rf /usr/local/lib/node_modules

and then

brew reinstall node

then install all your global package

npm install -g nodemon typescript ... (and all what you need)

[tjx666]

always recreate .DS_Store:

[itsmelion]

same as above

Manually deleting the .DS_Store file will allow an update, but the solution doesn't persist (the .DS_Store file is inevitably re-created).

when i fix, i don't get these errors for some time, but they come back. i'm trying to pay attention to what happens so they come back. (like today)

• Many days till this morning was fine, then i updated my MacOS and i got the error again.

[egrieco]

I ran into this bug when running npm via Topgrade.

Running:

find /usr/local/lib/node_modules -name '.bin'

Revealed a number of .bin directories. I cleaned them up with:

find /usr/local/lib/node_modules -name '.bin' -exec rm -rvf {} \;

[egrieco]

P.S. I find it odd that npm doctor did not complain about the .bin directories.

[bbilginerdem]

On windows, after installing the node again from their website. It stopped getting the issue, when using npm update -g.