[BUG] NPM Error: EPERM: operation not permitted. Tarball data for <package> seems to be corrupted

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

We are running build in Jenkins and we use Artifactory. We use Windows and Redhat virtual machines connected to Jenkins as our build nodes. We are running a multi-branch pipeline.

This error only happens on Windows. Re-running the command works and it can pass the stage.

We've tried clearing the NPM cache and recreating the node_modules folder as well as the package-lock.json file but we are still seeing these errors randomly.

This happens on all versions of Node and NPM.

Our theory so far is the following:

For some reason fetching large files occasionally fails. If that happens on linux, there is a file-handle leak but that doesn't prevent npm from trying again and finally successfully downloading the file. The file-handle leak on windows however prevents npm from deleting/overwriting the file in question in its further attempts. This ultimately causes npm ci (or install) to fail. Maybe there is a missing fs.closeSync(fd) in the respective npm code for fetching packages in case of an exception.

Any help is greatly appreciated, this has been happening for over 2 years.

Expected Behavior

npm commands run successfully without any interrupts or need to re-run

Steps To Reproduce

1. Jenkins multi-branch pipeline with Windows VM, using Artifactory
2. Any node and NPM version
3. Run any npm command related to Artifactory
4. Occasionally the command will fail with the EPERM tarball corrupted error

Environment

• npm: any
• Node.js: any
• OS Name: Windows
• npm config:

; ; cli configs                                                                             
metrics-registry = ""
scope = ""                                                                                
user-agent = "npm/6.14.12 node/v10.24.1 win32 x64"                                        
                                                                                          
; project config C:\cygwin64\home\username\.npmrc                                     
registry = "omitted"   
always-auth = true                                                                        
email = "omitted"                                                        
registry = "omitted"        
                                                                                          
; userconfig C:\Users\username\.npmrc                                                 
registry = "omitted"        
                                                                                          
; node bin location = C:\Program Files\nodejs\node.exe                                    
; cwd = C:\cygwin64\home\username                                                  
; HOME = C:\Users\username                                                       

Start by reviewing the Windows-only failure during npm ci or npm install against Artifactory in the Jenkins pipeline described here. The issue names no source files or tests, so first identify the npm tarball-fetching entry point and a way to reproduce the intermittent EPERM error. Done means the command completes reliably without reruns or corrupted-tarball failures.