[BUG] npm outdated script fails on workspaces with a package with name conflicting with an unpublished package in the public registry

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

I ran the npm outdated script on the root dir of an npm workspace.
I have a local package named api-types.
I got this error:

npm outdated
npm error code ENOVERSIONS
npm error No versions available for api-types

Expected Behavior

I expected the command to run successfully, showing the outdated packages in my repository.

Steps To Reproduce

1. Create a root package.json for an npm workspace, configuring the workspaces property correctly
2. Add a local package named admin-api-types for example
3. Run npm install to generate the package-lock.json
4. Run npm outdated: it works correctly up to now

Now, to introduce the bug:
5. Add a local package named api-types
6. Run npm install to update the package-lock.json
7. Run npm outdated: error

npm outdated
npm error code ENOVERSIONS
npm error No versions available for api-types
npm error A complete log of this run can be found in: /Users/kuteken/.npm/_logs/2026-08-07T15_26_06_628Z-debug-0.log

Opening the log, it shows these lines that caught my attention:

34 http fetch GET 404 https://registry.npmjs.org/admin-api-types 324ms (cache skip)
35 http fetch GET 200 https://registry.npmjs.org/api-types 328ms (cache miss)
36 verbose type range
37 verbose stack api-types: No versions available for api-types
37 verbose stack     at pickManifest (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/node_modules/npm-pick-manifest/lib/index.js:141:25)
37 verbose stack     at module.exports (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/node_modules/npm-pick-manifest/lib/index.js:188:16)
37 verbose stack     at #getOutdatedInfo (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/commands/outdated.js:194:22)
37 verbose stack     at async Promise.all (index 76)
37 verbose stack     at async Outdated.exec (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/commands/outdated.js:76:5)
37 verbose stack     at async Npm.exec (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/npm.js:193:9)
37 verbose stack     at async module.exports (/Users/kuteken/.nvm/versions/node/v24.14.0/lib/node_modules/npm/lib/cli/entry.js:67:5)

To finish off, I ran two new commands:

$ npm view api-types versions
npm error code E404
npm error 404 Unpublished on 2020-09-27T15:31:17.123Z
npm error 404
npm error 404  The requested resource 'api-types' could not be found or you do not have permission to access it.

$ npm view admin-api-types versions
npm error code E404
npm error 404 Not Found - GET https://registry.npmjs.org/admin-api-types - Not found
npm error 404
npm error 404  The requested resource 'admin-api-types@*' could not be found or you do not have permission to access it.

api-types is a local workspace package, but it also matches a package that was previously published and later unpublished from the npm registry. npm outdated appears to query the registry anyway, receives metadata for the unpublished package, and eventually throws ENOVERSIONS instead of treating the dependency as a local workspace.

In summary, this suggests the following:

• Running npm outdated fails when a local package coincides with an unpublished package in the npm public registry

I could reproduce it with another package named whatsapp-client, for example.

Environment

• npm: 12.0.2
• Node.js: v24.19.0
• OS Name: macOS 15.6
• System Model Name: Macbook Pro
• npm config:

; "user" config from /Users/kuteken/.npmrc

@indigohive:registry = "https://npm.pkg.github.com/"
//npm.pkg.github.com/:_authToken = (protected)
//registry.npmjs.org/:_authToken = (protected)

; node bin location = /Users/kuteken/.nvm/versions/node/v24.19.0/bin/node
; node version = v24.19.0
; npm local prefix = /Users/kuteken/git/indigohive/whatsapp
; npm version = 12.0.2
; cwd = /Users/kuteken/git/indigohive/whatsapp
; HOME = /Users/kuteken
; Run `npm config ls -l` to show all defaults.

Start in npm/lib/commands/outdated.js at #getOutdatedInfo and inspect how workspace packages are handled before registry metadata is selected; npm-pick-manifest/lib/index.js appears in the reported stack. Reproduce the workspace with a local package matching an unpublished registry name, then verify that npm outdated completes and reports outdated packages instead of failing with ENOVERSIONS.