[BUG] `npm link` tries accessing the network

[Hi-Angel]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

It prints a network related error:

npm error code EAI_AGAIN
npm error syscall getaddrinfo
npm error errno EAI_AGAIN
npm error request to https://registry.npmjs.org/react-dom failed, reason: getaddrinfo EAI_AGAIN registry.npmjs.org
npm error A complete log of this run can be found in: /root/.npm/_logs/2025-08-15T13_42_32_900Z-debug-0.log

Expected Behavior

Any error that is not network-related (e.g. because there's no packages.json) or success.

Steps To Reproduce

npm link is documented to only create a symlink, but instead it downloads stuff.

This might be a huge issue globally, because npm commands are often called in CI, and it is usually assumed that by the time npm link is called CI has all the deps cached (otherwise every pipeline someone somewhere triggers would result in accessing nodejs servers without devopses knowing it).

So unfortunately, npm link exhibits undocumented behavior where if it doesn't find deps in the system, it goes out online and silently fetches stuff from the internet, which puts excess load on both the users of CI and the nodejs servers.

To reproduce (in terms of terminal commands):

$ mkdir -p /tmp/foo && cd /tmp/foo
$ echo 'FROM docker.io/library/fedora:41\nRUN dnf install -y npm sqlite3' > Dockerfile
$ podman build -f Dockerfile -t test
[…build output snipped…]
$ podman run --rm --net=none test npm link react-dom
npm error code EAI_AGAIN
npm error syscall getaddrinfo
npm error errno EAI_AGAIN
npm error request to https://registry.npmjs.org/react-dom failed, reason: getaddrinfo EAI_AGAIN registry.npmjs.org
npm error A complete log of this run can be found in: /root/.npm/_logs/2025-08-15T13_42_32_900Z-debug-0.log

Environment

• npm: 11.5.2
• Node.js: v24.5.0
• OS Name: Archlinux
• System Model Name: Dell G15
• npm config:

; node bin location = /usr/bin/node
; node version = v24.5.0
; npm local prefix = /tmp/foo
; npm version = 11.5.2
; cwd = /tmp/foo
; HOME = /home/constantine
; Run `npm config ls -l` to show all defaults.

[milaninfy]

@Hi-Angel Thank you for your report. The way npm link work is firstly you run npm link to your local package directory to link a package to global space then secondly wherever you want to use that package at that directory you run npm link your-local-package-name to have it symlinked from global.

if there are packages missing in global then it will first fetch the package and then symlink.

when you are running npm link react-dom it's checking if it's there in global since it's not there it's first fetching from registry and then will try to link it.

[Hi-Angel]

Thank you for details, that's correct.

Just to clarify, the "download" part isn't documented; but the problem isn't the lack of documentation, but that the behavior is actively harmful.

[Hi-Angel]

The problem is even deeper than I thought. In our local CI case I manually made sure deps are installed, so there would be no reason for npm to try to access the internet. Well, what I found is that it tries to do some "audit" which nobody asked it for:

131 silly audit bulk request failed undefined
132 verbose audit error FetchError: request to https://registry.npmjs.org/-/npm/v1/security/audits/quick failed, reason: getaddrinfo EAI_AGAIN registry.npmjs.org
132 verbose audit error     at ClientRequest.<anonymous> (/usr/lib/node_modules_22/npm/node_modules/minipass-fetch/lib/index.js:130:14)
132 verbose audit error     at ClientRequest.emit (node:events:518:28)
132 verbose audit error     at emitErrorEvent (node:_http_client:104:11)
132 verbose audit error     at _destroy (node:_http_client:898:9)
132 verbose audit error     at onSocketNT (node:_http_client:918:5)
132 verbose audit error     at process.processTicksAndRejections (node:internal/process/task_queues:91:21) {
132 verbose audit error   code: 'EAI_AGAIN',
132 verbose audit error   errno: 'EAI_AGAIN',
132 verbose audit error   syscall: 'getaddrinfo',
132 verbose audit error   hostname: 'registry.npmjs.org',
132 verbose audit error   type: 'system'
132 verbose audit error }
133 silly audit error undefined
134 silly audit report null

but it seems like this error isn't what's causing it to fail. What does though is a wall of log entries similar to these 3 for different packages:

[…]
145 http cache vite-plugin-svgr@https://registry.npmjs.org/vite-plugin-svgr/-/vite-plugin-svgr-4.3.0.tgz 0ms (cache hit)
[…]
503 silly tarball no local data for vite@https://registry.npmjs.org/vite/-/vite-7.0.3.tgz. Extracting by manifest.
[…]
557 http fetch GET https://registry.npmjs.org/vite/-/vite-7.0.3.tgz attempt 1 failed with EAI_AGAIN

I studied the code for "no local data" error, and per my understanding it's searching for some .tgz file in node_modules, not finding it, and then goes online.

Per my understanding, none of that has anything to do with npm link functional. Why would npm link @typescript-eslint/eslint-plugin even look at vite, not to mention search for some .tgz file, not a single one of which is to be found inside node_modules/… with all deps installed.