Owner

npm

8 indexed repositories · View on GitHub

cli
the package manager for JavaScript

JavaScript · 10122 stars
rfcs
Public change requests/proposals & ideation

JavaScript · 778 stars
documentation
Documentation for the npm registry, website, and command-line interface.

MDX · 712 stars
pacote
npm fetcher

JavaScript · 399 stars
statusboard
Public monitor/status/health board for @npm/cli-team's maintained projects

JavaScript · 210 stars
npm-packlist
Walk through a folder and figure out what goes in an npm package

JavaScript · 121 stars
action-deploy
Action to manage GitHub deployments

TypeScript · 13 stars
api-documentation
API documentation for npm registry

Handlebars · 5 stars

Beginner friendly Everything

Open All

Fixed the CI failures — ready for re-review! 🙏 Open

Difficulty 2/5 1-3 hours Newbie friendliness 15/100

npm/cli#9999 · 1 comment · Opened Sep 19, 2026
Request for npm 12 (re-)submission to Node.js `main` branch Open

Difficulty 4/5 3-5 days Newbie friendliness 42/100

npm/cli#9997 · 1 reaction · Opened Sep 18, 2026
npm ls marks satisfied edges invalid when sibling override rulesets disagree about an unrelated, not-installed package Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

npm/cli#9996 · Opened Sep 17, 2026
[BUG] `npm install-scripts approve`/`deny` ignore `--dry-run` and write to package.json Open

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

npm/cli#9992 · Opened Sep 16, 2026
[RRFC] Let a package register its own OIDC issuer for trusted publishing Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

npm/rfcs#924 · Opened Sep 16, 2026
New package missing from registry search index for 3+ days Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

npm/cli#9991 · Opened Sep 16, 2026
[BUG] allow-git=root does not work for overrides Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9984 · 1 comment · Opened Sep 15, 2026
[BUG] Workspace lifecycle scripts silently skipped under `install-strategy=linked` Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 75/100

npm/cli#9982 · 2 comments · Opened Sep 15, 2026
[BUG] Changing `packageExtensions` or `.npm-extension` upgrades locked packages to the newest version in range Open

Bug Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

npm/cli#9981 · Opened Sep 15, 2026
[BUG] `npm ls` flags installed optional peers as extraneous under `install-strategy=linked` Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9980 · Opened Sep 15, 2026
[BUG] Unresolvable dependency that is also a peer reports ERESOLVE `Found: <pkg>@undefined` instead of ETARGET Open

Bug Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 52/100

npm/cli#9979 · Opened Sep 15, 2026
[BUG] ERESOLVE in a workspace graph with shared dependents exits 1 with no error message Open

Bug Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 48/100

npm/cli#9978 · Opened Sep 15, 2026
[BUG] `npm install` does not repair invalid or missing lockfile deps behind a workspace, so `strict-peer-deps` passes Open

Bug Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9977 · Opened Sep 15, 2026
[BUG] `npm ls` reports dist-tag dependencies as invalid under `install-strategy=linked` Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 74/100

npm/cli#9976 · Opened Sep 15, 2026
[BUG] script-shell is resolved against cwd not workspace root or relative to .npmrc Open

Bug Needs Triage

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9970 · 1 comment · Opened Sep 14, 2026
[BUG] OIDC trusted publishing fails with "package not found" for GitHub repos that use immutable OIDC subject claims Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

npm/cli#9969 · Opened Sep 14, 2026
[BUG] npm exec / npx forwards persistent user-level allow-scripts to children as npm_config_allow_scripts, failing project-scoped installs in the child (EALLOWSCRIPTS) Open

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9968 · Opened Sep 14, 2026
[BUG] `npm install` ignores Git SHA changes Open

Bug Priority 2

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9966 · 1 comment · Opened Sep 12, 2026
[BUG] Inconsistent behavior of `--omit=optional` in `npm i` and `npm ls` Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9962 · Opened Sep 11, 2026
npm error Cannot read properties of null (reading 'edgesOut') Open

Awaiting Information Bug

Difficulty 4/5 3-5 days Newbie friendliness 20/100

npm/cli#9960 · 1 comment · Opened Sep 9, 2026
npx -y hangs on Windows when stdin is a pipe (deadlock with MCP/LSP stdio IPC) Open

Priority 2

Difficulty 4/5 3-5 days Newbie friendliness 48/100

npm/cli#9959 · 1 comment · Opened Sep 9, 2026
[BUG] Misleading 401 "npm tokens that bypass 2FA are being restricted" error when using a token that doesn't bypass 2FA Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 64/100

npm/cli#9957 · 1 comment · Opened Sep 9, 2026
`npm diff` runs `prepare` scripts while comparing local directories Open

Difficulty 4/5 3-5 days Newbie friendliness 50/100

npm/cli#9955 · Opened Sep 7, 2026
[BUG] `npm link` warns about install scripts that no allowScripts mechanism can cover Open

Difficulty 4/5 3-5 days Newbie friendliness 68/100

npm/cli#9951 · 2 comments · Opened Sep 4, 2026
[BUG] Published npm manifest references unshipped workspaces and devDependencies, so npm cannot install/audit inside its own package directory Open

Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9949 · Opened Sep 3, 2026
[BUG] npm login does not accept email address as an username for custom registries Open

Bug Priority 3

Difficulty 4/5 3-5 days Newbie friendliness 50/100

npm/cli#9946 · Opened Sep 3, 2026
[BUG] npm install doesn't report post-install script warning when root project has prepare hook that fails Open

allowScripts Bug cmd:install ws:arborist

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9943 · Opened Sep 3, 2026
[BUG] Verbose and duplicate entries in `allowScripts` created when `install-strategy=linked` Open

allowScripts Bug Needs Triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9939 · 5 comments · Opened Sep 1, 2026
[BUG] npm install livelocks (100% CPU, infinite CanPlaceDep/canPlacePeers cycle) on dependency graph with cyclic peerDependencies Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

npm/cli#9934 · Opened Aug 29, 2026
[BUG] OIDC failures aren't logged by default Open

Bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

npm/cli#9923 · Opened Aug 27, 2026
[BUG] npm install -g crashes: Cannot read properties of null (reading 'children') when a peer set resolves across multiple prerelease lines Open

Bug cmd:install Needs Triage ws:arborist

Difficulty 4/5 3-5 days Newbie friendliness 68/100

npm/cli#9911 · 2 comments · Opened Aug 23, 2026
[BUG] npm fails to find hoisted bin files in monorepo when parent directory path contains a ':' character Open

Bug cmd:run-script config:workspaces Needs Triage platform: linux

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9910 · 2 comments · Opened Aug 23, 2026
- name: Setup Java JDK uses: actions/setup-java@v5.7.0 Open

Difficulty 4/5 3-5 days Newbie friendliness 20/100

npm/documentation#2026 · Opened Aug 20, 2026
[BUG] npm notice run npx, npm notice run 'cypress' --version Open

Bug cmd:exec config:global ws:libnpmexec

Difficulty 3/5 1-2 days Newbie friendliness 48/100

npm/cli#9893 · Opened Aug 18, 2026
const command_line::arg_descriptor<bool> arg_restricted = {"restricted-rpc", "Restricts to view-only commands", false}; Open

Difficulty 5/5 Over a week Newbie friendliness 10/100

npm/documentation#2025 · 1 comment · Opened Aug 18, 2026
[BUG] install hangs indefinitely instead of failing with ETARGET when --min-release-age rejects the requested version Open

Bug cmd:install ws:arborist

Difficulty 4/5 3-5 days Newbie friendliness 45/100

npm/cli#9891 · 2 comments · Opened Aug 18, 2026
npm exec (npx) links bins to the wrong directory when run from a global install's lifecycle script, causing "command not found" and install rollback Open

Bug cmd:exec config:global ws:libnpmexec

Difficulty 4/5 3-5 days Newbie friendliness 68/100

npm/cli#9890 · Opened Aug 18, 2026
[BUG] 409 "Cannot publish over previously staged version" for a package that never used staged publishing Open

Bug Registry

Difficulty 4/5 3-5 days Newbie friendliness 38/100

npm/cli#9889 · 2 comments · 1 reaction · Opened Aug 18, 2026
[RRFC] <title> Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

npm/rfcs#915 · Opened Aug 16, 2026
Consistent naming of package parameter Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

npm/api-documentation#74 · Opened Aug 15, 2026
[BUG] `npm ls --json --long` outputs nothing and exits 1 when a deprecation message contains a URL (redaction corrupts compact JSON) Open

Bug cmd:list config:display Priority 2 regresion:11.x

Difficulty 3/5 1-2 days Newbie friendliness 74/100

npm/cli#9873 · Opened Aug 14, 2026
[BUG] npx --yes <pkg> fails with 'sh: <bin>: command not found' — npx cache bin dir is not added to the spawned shell's PATH Open

Difficulty 4/5 3-5 days Newbie friendliness 65/100

npm/cli#9870 · 1 reaction · Opened Aug 13, 2026
NPM START... Open

Difficulty 4/5 3-5 days Newbie friendliness 15/100

npm/documentation#2020 · 1 comment · Opened Aug 12, 2026
[BUG] Direct dependency's bin can be overwritten by a transitive dependency based on lexical package name Open

Bug cmd:install ws:arborist

Difficulty 4/5 3-5 days Newbie friendliness 48/100

npm/cli#9868 · 1 reaction · Opened Aug 11, 2026
Bundled ip-address dependency vulnerable to SSRF (CVE-2026-69192 / GHSA-mwp4-54f8-5fhr) Open

Dependencies Security

npm/cli#9867 · 2 comments · 1 assignee · Opened Aug 11, 2026
npm 12 on Windows strips all bin entries as invalid regardless of format Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

npm/cli#9861 · 1 comment · Opened Aug 9, 2026
[BUG] npm login exits 1 with no error message when stdin is not interactive Open

Bug

npm/cli#9860 · 1 assignee · Opened Aug 8, 2026
[BUG] Root preinstall cannot update registry credentials for the active npm install Open

Bug

Difficulty 4/5 3-5 days Newbie friendliness 54/100

npm/cli#9853 · Opened Aug 7, 2026
[BUG] npm outdated script fails on workspaces with a package with name conflicting with an unpublished package in the public registry Open

Bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

npm/cli#9852 · 1 comment · 2 reactions · Opened Aug 7, 2026
[BUG] Scoped npm ci --workspace installs an out-of-scope workspace's optional peer dependency, then reports it as extraneous Open

Bug config:workspace Priority 2

Difficulty 4/5 3-5 days Newbie friendliness 55/100

npm/cli#9847 · Opened Aug 6, 2026

Showing the newest 100

This page lists what was indexed most recently. Advanced filter has the whole inventory, narrowed by language, difficulty and how long a task takes.

Open advanced filter

npm

Showing the newest 100

Get new issues in your inbox