npm ERR! code E403

You do not have permission to access this package.

Frequently documented in developer and vendor support forums.

• Private package
• No publish rights
• Package scope issue

1. Check package access settings
2. Add to organization team
3. Verify package name scope

Last reviewed: March 2026 How we review solutions

npm returns E403 when the registry server recognizes your credentials but denies the specific action you attempted. Unlike E401, which means "I do not know who you are," E403 means "I know who you are, but you are not allowed to do this." The most common trigger is trying to publish a package with a name that already exists on the public registry and belongs to someone else. npm's public registry has over two million packages, and popular short names are almost always taken. Scoped packages (@yourorg/package-name) avoid this conflict because the scope acts as a namespace. Another frequent cause is attempting to republish an existing version—npm enforces immutable versions, so publishing 1.0.0 twice is forbidden even if you are the package owner. Corporate registries add another layer: your registry admin may restrict who can publish, which packages can be installed, or which IP ranges can access the registry. npm Enterprise and Artifactory both support fine-grained access control that can return 403 for policy violations like disallowed licenses or unapproved packages.

1. Check if the package name is already taken: npm view package-name
2. Verify you are listed as a maintainer: npm owner ls package-name
3. Ensure you are not republishing an existing version (bump the version first)
4. Check if your organization requires specific publish permissions
5. For scoped packages, verify the scope matches your authenticated org

Package name squatting dispute

If someone registered a package name you believe you have rights to (trademark, company name), you can file a dispute through npm support. The process takes time, so use a scoped package name as an immediate workaround.

npm publish after unpublish within 24 hours

After unpublishing a package, npm blocks republishing the same name for 24 hours to prevent dependency confusion attacks. Wait 24 hours or publish under a different name.

Corporate registry license policy block

Enterprise registries like Artifactory can block packages based on license type (GPL, AGPL). The 403 response may include a policy violation message. Contact your registry admin to approve the package or find an alternative with a compatible license.

What is a scope?

@org/package-name format for organization packages.

How to publish public?

Use npm publish --access public.

Can I publish a package with the same name as a deleted one?

Not immediately. npm reserves unpublished package names for 24 hours. After that window, the name becomes available again, but popular names are often re-registered quickly.

How do I transfer package ownership to another user?

Use npm owner add username package-name to add a co-maintainer. The new owner can then publish. Use npm owner rm to remove yourself if you want to fully transfer ownership.

Why does npm install give E403 for a public package?

This typically means a corporate proxy or firewall is blocking access. Some organizations restrict which public packages can be installed. Check with your IT team or try installing from the public registry directly: npm install package-name --registry=https://registry.npmjs.org/

• npm install – Official npm Docs
• package.json Reference – npm Docs