404 on viewing NPM package

[stevewlrls]

Select Topic Area

Question

Body

I have published several NPM packages to the Github registry: all private and all scoped under a Github organisation. For all but one of them, when I list the organisation's packages and click on the entry, I am able to view and manage the package. For one, however, I see the package in the list but when I click on it I get a 404 error. I can't find any guidance about this issue and obviously I cannot delete the package if I can't see it. [I am not the owner of the organisation but I am - or should be - the owner of all the packages.] I can still publish new versions of the package, from the npm command line, and I can still fetch the package with 'npm install'.
Any suggestions?

[knarrff]

Hi @stevewlrls

How do you authenticate when using nmp? Is that by any chance not using your personal account (token), but some token not associated to your account that may have been added to the project? If so, this could explain what you see: when you use your personal account (like on the web interface), you might not have access (because someone might not have added or might have removed you), but using the project access token you can still interact with the project.

[knarrff]

I created all the packages the same way - with 'npm publish' - using a PAT (in ~.npmrc) for authentication. And I have neither cancelled nor changed the PAT. I have asked the project owner to check whether the package access has somehow been changed. [We have generated no project tokens.]

Checking those again is a good idea.

I am also a little puzzled. Can you try the following: take the repostorie's URL. Use it in your browser, while logged in. I suspect, that is when you get the 404. Also use the same URL to clone the repository using git, using your PAT. Does that work? Is there anything special about the URL - special characters maybe?

[stevewlrls]

Please note: I have no problem viewing or interacting with repositories. However, your question reminded me that I renamed the repository linked to the package. I have tried renaming it back, but that did not resolve the issue.

[stevewlrls]

You are correct that when I use npm commands, I am authenticating with a PAT, whilst when I view online I am logged in 'normally' (with Mac passkey). But the PAT should still identify 'me' as the security principal. The package name has no special characters in it and the URL for which I get the 404 has the same form as for other packages that 'work'. (Only the package name changes.) I wonder if this is a bug in Github whereby if the repo is renamed, the link from the package breaks and that then prevents the package page from being displayed.

[knarrff]

I agree: your PAT should give you the same level of access. That is why I asked about project tokens before - but this doesn't seem to be the issue here. If this is the only repo you renamed and then you have problems with only that package, it does suggest a correlation with the rename. Renaming repos shouldn't break packages in the first place and even if so, renaming it back should fix it, I also agree here.

I am sorry, I am at a loss, like you: if renaming does not resolve it - maybe it takes a little for the system to pick up on this, but even if I would not expect it to take long - it might be time to open a bug report. I suspect a github employee has better access for debugging than we have.

[stevewlrls]

First I'll wait for the organisation owner to see if they can view the package ... If so, it'll point to an access issue; if not, it'll point to a bug [in my view]. Thanks for your attention.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[stevewlrls]

I raised an issue for the Github team to investigate and was told that the package name had somehow acquired an extra, non-displaying character, which was being stripped when the link was being created, inside the GitHub Code. Hence the 404 when clicking that link. I was also told how to add that character into the URL to access the package page, manually, and was then able to delete the package and recreate it. Problem solved.