[BUG] `allow-directory=none|root` breaks `npx`

[fenichelar]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

When allow-directory is set to none or root, commands run using npx fail with the below error:

npm error code EALLOWDIRECTORY
npm error Fetching packages of type "directory" have been disabled
npm error A complete log of this run can be found in: /Users/example/.npm/_logs/2026-05-22T15_59_42_054Z-debug-0.log

Note that the above error is for none. If set to if set to root the error says Fetching **non-root** packages, but the rest is the same.

Below is the output of the debug log (when running npx npm as an example):

0 verbose cli /Users/example/.nvm/versions/node/v24.16.0/bin/node /Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/bin/npm-cli.js
1 info using npm@11.15.0
2 info using node@v24.16.0
3 silly config load:file:/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/npmrc
4 silly config load:file:/Users/example/test/.npmrc
5 silly config load:file:/Users/example/.npmrc
6 silly config load:file:/Users/example/.nvm/versions/node/v24.16.0/etc/npmrc
7 verbose title npm exec npm
8 verbose argv "exec" "--" "npm"
9 verbose logfile logs-max:10 dir:/Users/example/.npm/_logs/2026-05-22T15_59_42_054Z-
10 verbose logfile /Users/example/.npm/_logs/2026-05-22T15_59_42_054Z-debug-0.log
11 silly logfile start cleaning logs, removing 1 files
12 silly logfile done cleaning log files
13 verbose stack Error: Fetching packages of type "directory" have been disabled
13 verbose stack     at canUse (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/pacote/lib/fetcher.js:481:5)
13 verbose stack     at FetcherBase.get (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/pacote/lib/fetcher.js:513:7)
13 verbose stack     at Object.manifest (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/pacote/lib/index.js:20:29)
13 verbose stack     at hasPkgBin (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:91:10)
13 verbose stack     at exec (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/libnpmexec/lib/index.js:146:17)
13 verbose stack     at Exec.callExec (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/lib/commands/exec.js:77:12)
13 verbose stack     at Exec.exec (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/lib/commands/exec.js:28:17)
13 verbose stack     at /Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/lib/npm.js:308:81
13 verbose stack     at Object.start (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/node_modules/proc-log/lib/index.js:101:21)
13 verbose stack     at Npm.execCommandClass (/Users/example/.nvm/versions/node/v24.16.0/lib/node_modules/npm/lib/npm.js:307:19)
14 error code EALLOWDIRECTORY
15 error Fetching packages of type "directory" have been disabled
16 verbose cwd /Users/example/test
17 verbose os Darwin 25.5.0
18 verbose node v24.16.0
19 verbose npm  v11.15.0
20 verbose exit 1
21 verbose code 1
22 error A complete log of this run can be found in: /Users/example/.npm/_logs/2026-05-22T15_59_42_054Z-debug-0.log

Expected Behavior

I don't believe allow-directory=none or allow-directory=root are intended to prevent the use of npx.

Steps To Reproduce

The below example uses npx npm but it doesn't appear to matter what command is used with npx, npx eslint, npx tsc, etc. all fail with the same error.

npm init -y
echo "allow-directory=none" > .npmrc
npx npm

Environment

• npm: 11.15.0
• Node.js: v24.16.0
• OS Name: macOS 26.5
• System Model Name: MacBook Pro
• npm config:

; "project" config from /Users/example/test/.npmrc

allow-directory = "none"

; node bin location = /Users/example/.nvm/versions/node/v24.16.0/bin/node
; node version = v24.16.0
; npm local prefix = /Users/example/test
; npm version = 11.15.0
; cwd = /Users/example/test
; HOME = /Users/example
; Run `npm config ls -l` to show all defaults.

[KaloudasDev]

@fenichelar The issue is that npx uses libnpmexec which internally calls pacote.manifest to resolve the package being executed. When allow-directory=none is set, pacote blocks any attempt to fetch a directory-type package. npx treats certain packages (including locally installed ones or packages without a registry entry) as directory-type, causing the error.

The fix requires libnpmexec to bypass the directory restriction when resolving packages for npx, or to handle the EALLOWDIRECTORY error gracefully and fall back to a different resolution method.

Until fixed, the workaround is not to set allow-directory=none or allow-directory=root if you need npx, or to set allow-directory to always when using npx.