Skip to content

[BUG] Publishing another version with OIDC fails to find an earlier published version of a scoped package #8678

Closed
aptos-labs/aptos-client
#18
Closed
[BUG] Publishing another version with OIDC fails to find an earlier published version of a scoped package#8678
aptos-labs/aptos-client
#18
Labels
Bugthing that needs fixingNeeds Triageneeds review for next steps

Description

@prantlf
prantlf
opened on Oct 15, 2025

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

I enabled trusted publishing with OICD for the NPM package @mockfetch/mockfetch and GitHub repo prantlf/mockfetch.git. Running npm publish --access public --verbose failed.

At first, the publishing permission was granted:

npm http fetch GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/61//idtoken/***/***?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 82ms

Then an error occurred:

npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@mockfetch%2fmockfetch 574ms
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found

Publishing continued by successful fetching the current version of the package:

npm http fetch GET 200 https://registry.npmjs.org/@mockfetch%2fmockfetch 709ms (cache miss)
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access

Eventually a fatal error occurred:

npm http fetch PUT 404 https://registry.npmjs.org/@mockfetch%2fmockfetch 159ms
npm verbose stack HttpErrorGeneral: 404 Not Found - PUT https://registry.npmjs.org/@mockfetch%2fmockfetch - Not found
npm verbose stack     at /opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:103:15
npm verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
npm verbose stack     at async publish (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/publish.js:53:15)
npm verbose stack     at async otplease (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/utils/auth.js:8:12)
npm verbose stack     at async #publish (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/commands/publish.js:188:7)
npm verbose stack     at async Publish.exec (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/commands/publish.js:47:5)
npm verbose stack     at async Npm.exec (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/npm.js:208:9)
npm verbose stack     at async module.exports (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/cli/entry.js:67:5)
npm verbose statusCode 404
npm verbose pkgid @mockfetch/mockfetch@0.1.1
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@mockfetch%2fmockfetch - Not found
npm error 404
npm error 404  The requested resource '@mockfetch/mockfetch@0.1.1' could not be found or you do not have permission to access it.

Can it be that the "package not found" error was caused by the scoped package?

The full log:

Run npm publish --access public --verbose
  npm publish --access public --verbose
  shell: /usr/bin/bash -e {0}
  env:
    PNPM_HOME: /home/runner/setup-pnpm/node_modules/.bin
    NPM_CONFIG_USERCONFIG: /home/runner/work/_temp/.npmrc
    NODE_AUTH_TOKEN: XXXXX-XXXXX-XXXXX-XXXXX
npm verbose cli /opt/hostedtoolcache/node/24.10.0/x64/bin/node /opt/hostedtoolcache/node/24.10.0/x64/bin/npm
npm info using npm@11.6.2
npm info using node@v24.10.0
npm warn Unknown user config "always-auth". This will stop working in the next major version of npm.
npm verbose title npm publish
npm verbose argv "publish" "--access" "public" "--loglevel" "verbose"
npm verbose logfile logs-max:10 dir:/home/runner/.npm/_logs/2025-10-15T22_35_45_629Z-
npm verbose logfile /home/runner/.npm/_logs/2025-10-15T22_35_45_629Z-debug-0.log
npm verbose publish [ '.' ]
npm notice
npm notice 📦  @mockfetch/mockfetch@0.1.1
npm notice Tarball Contents
npm notice 1.1kB LICENSE
npm notice 6.1kB README.md
npm notice 6.6kB lib/index.cjs
npm notice 12.7kB lib/index.cjs.map
npm notice 1.6kB lib/index.d.ts
npm notice 6.1kB lib/index.js
npm notice 3.1kB lib/index.min.js
npm notice 11.8kB lib/index.min.js.map
npm notice 7.3kB lib/index.umd.js
npm notice 12.7kB lib/index.umd.js.map
npm notice 3.3kB lib/index.umd.min.js
npm notice 11.6kB lib/index.umd.min.js.map
npm notice 1.4kB package.json
npm notice Tarball Details
npm notice name: @mockfetch/mockfetch
npm notice version: 0.1.1
npm notice filename: mockfetch-mockfetch-0.1.1.tgz
npm notice package size: 14.2 kB
npm notice unpacked size: 85.5 kB
npm notice shasum: 0ab427df4157edb7ffbbd8b2d49566feb7efea5a
npm notice integrity: sha512-D8eDfCEWqRJGy[...]UqDVqaEzwtuVw==
npm notice total files: 13
npm notice
npm http fetch GET https://run-actions-3-azure-eastus.actions.githubusercontent.com/61//idtoken/***/***?api-version=2.0&audience=npm%3Aregistry.npmjs.org 200 82ms
npm notice SECURITY NOTICE: Breaking changes starting October 13, 2025. New tokens will be limited to a maximum lifetime of 90 days, and TOTP setup will be disabled. Classic tokens will be revoked in November. Update your CI/CD workflows to avoid disruption. Learn more: https://gh.io/npm-token-changes
npm http fetch POST 404 https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/@mockfetch%2fmockfetch 574ms
npm verbose oidc Failed token exchange request with body message: OIDC token exchange error - package not found
npm http fetch GET 200 https://registry.npmjs.org/@mockfetch%2fmockfetch 709ms (cache miss)
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm http fetch PUT 404 https://registry.npmjs.org/@mockfetch%2fmockfetch 159ms
npm verbose stack HttpErrorGeneral: 404 Not Found - PUT https://registry.npmjs.org/@mockfetch%2fmockfetch - Not found
npm verbose stack     at /opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:103:15
npm verbose stack     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
npm verbose stack     at async publish (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/publish.js:53:15)
npm verbose stack     at async otplease (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/utils/auth.js:8:12)
npm verbose stack     at async #publish (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/commands/publish.js:188:7)
npm verbose stack     at async Publish.exec (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/commands/publish.js:47:5)
npm verbose stack     at async Npm.exec (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/npm.js:208:9)
npm verbose stack     at async module.exports (/opt/hostedtoolcache/node/24.10.0/x64/lib/node_modules/npm/lib/cli/entry.js:67:5)
npm verbose statusCode 404
npm verbose pkgid @mockfetch/mockfetch@0.1.1
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/@mockfetch%2fmockfetch - Not found
npm error 404
npm error 404  The requested resource '@mockfetch/mockfetch@0.1.1' could not be found or you do not have permission to access it.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.
npm verbose cwd /home/runner/work/mockfetch/mockfetch
npm verbose os Linux 6.11.0-1018-azure
npm verbose node v24.10.0
npm verbose npm  v11.6.2
npm verbose exit 1
npm verbose code 1
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2025-10-15T22_35_45_629Z-debug-0.log
Error: Process completed with exit code 1.

Expected Behavior

Running npm publish --access public --verbose should succeed.

Steps To Reproduce

Environment

  • npm: 11.6.2
  • Node.js: 24.10.0
  • OS Name: Ubuntu 24.04.3
  • System Model Name: VM used for running GitHub Actions
  • npm config:
; node bin location = /opt/hostedtoolcache/node/24.10.0/x64/bin/node
; node version = v24.10.0
; npm local prefix = /home/runner/work/mockfetch/mockfetch
; npm version = 11.6.2
; cwd = /home/runner/work/mockfetch/mockfetch
; HOME = /home/runner
; Run `npm config ls -l` to show all defaults.
  • npm config complete:
; "default" config from default values

_auth = (protected)
access = null
all = false
allow-same-version = false
also = null
audit = true
audit-level = null
auth-type = "web"
before = null
bin-links = true
browser = null
ca = null
cache = "/home/runner/.npm"
cache-max = null
cache-min = 0
cafile = null
call = ""
cert = null
cidr = null
color = true
commit-hooks = true
cpu = null
depth = null
description = true
dev = false
diff = []
diff-dst-prefix = "b/"
diff-ignore-all-space = false
diff-name-only = false
diff-no-prefix = false
scope = ""
script-shell = null
searchexclude = ""
searchlimit = 20
searchopts = ""
searchstaleness = 900
shell = "/bin/bash"
shrinkwrap = true
sign-git-commit = false
sign-git-tag = false
strict-peer-deps = false
strict-ssl = true
tag = "latest"
tag-version-prefix = "v"
timing = false
umask = 0
unicode = true
update-notifier = true
usage = false
user-agent = "npm/{npm-version} node/{node-version} {platform} {arch} workspaces/{workspaces} {ci}"
; userconfig = "/home/runner/.npmrc" ; overridden by env
version = false
versions = false
viewer = "man"
which = null
workspace = []
workspaces = null
workspaces-update = true
yes = null

; "user" config from /home/runner/work/_temp/.npmrc

//registry.npmjs.org/:_authToken = (protected)
always-auth = false
registry = "https://registry.npmjs.org/"

; "env" config from environment

userconfig = "/home/runner/work/_temp/.npmrc"

; "cli" config from command line options

long = true

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Triageneeds review for next steps

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions