How to fix npm ERR! Error: EACCES: permission denied, lstat '<path>' in npm

npmBEGINNERMEDIUMUpdated Dec 2, 2025· 232 views

npm cannot lstat a path (often a symlink or directory) because permissions block reading metadata. Fix ownership, remove bad symlinks, and run from user-writable filesystems.

Quick fix

Fixes npm ERR! Error: EACCES: permission denied, lstat '<path>'

find node_modules -xtype l -maxdepth 4 2>/dev/null | head
stat <path>
  1. Find and inspect symlinks
  2. Remove bad links and clean install
  3. Fix ownership for workspace and prefix
  4. Use user-owned cache and prefix
npm — error
find node_modules -xtype l -maxdepth 4 2>/dev/null | head
stat <path>
npm ERR! Error: EACCES: permission denied, lstat '<path>'

What this error means

npm uses lstat to examine files and symlinks before copying or linking them. If the path is root-owned, on a restricted filesystem, or a symlink pointing into a protected location, lstat returns EACCES and npm stops. It commonly appears when node_modules contains symlinks left from npm link/yarn, when global prefixes are root-owned, on WSL2 NTFS mounts with Windows ACLs, or in Docker/CI when the workspace is not owned by the npm user.

Typical symptoms

  • npm install/ci fails with EACCES: lstat '<path>'
  • Works with sudo/Admin but not as normal user
  • Symlinks in node_modules point to unreadable locations
  • npm link-ed packages fail with permission errors
  • WSL/Windows paths show file-in-use or ACL warnings

Common causes

  1. Root-owned symlinks or directories from prior sudo installs
  2. Symlinks pointing into protected system/global locations
  3. NTFS/SMB mounts (WSL2, network shares) blocking lstat
  4. Docker/CI workspace owned by root while npm runs as another user
  5. Antivirus/EDR locking linked files
  6. Corporate policies restricting /usr/local or /opt/homebrew

How to fix "npm ERR! Error: EACCES: permission denied, lstat '<path>'"

1Find and inspect symlinks
bash
find node_modules -xtype l -maxdepth 4 2>/dev/null | head
stat <path>
2Remove bad links and clean install
bash
find node_modules -xtype l -delete 2>/dev/null
rm -rf node_modules package-lock.json
npm cache clean --force
npm ci
3Fix ownership for workspace and prefix
bash
sudo chown -R $(whoami) .
sudo chown -R $(whoami) $(npm config get prefix)/{lib/node_modules,bin,share}
4Use user-owned cache and prefix
bash
npm config set cache ~/.npm-cache
mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
export PATH="$HOME/.npm-global/bin:$PATH"
5Work on a POSIX-friendly filesystem

On WSL, move the project to ext4 (~/projects). In Docker, run with matching UID/GID or chown the bind mount before installing.

6Reattempt install
bash
npm install

Advanced notes

npm link creates symlinks into global installs; if the global prefix is root-owned, lstat on those links fails—either unlink or reinstall the package locally. Long Windows paths and NTFS ACLs can also break lstat; shorter paths on the Linux filesystem avoid it. In CI, clear any vendor caches copied from root-owned images before running npm ci.

Frequently asked questions

What does "npm ERR! Error: EACCES: permission denied, lstat '<path>'" mean?
npm uses lstat to examine files and symlinks before copying or linking them. If the path is root-owned, on a restricted filesystem, or a symlink pointing into a protected location, lstat returns EACCES and npm stops. It commonly appears when node_modules contains symlinks left from npm link/yarn, when global prefixes are root-owned, on WSL2 NTFS mounts with Windows ACLs, or in Docker/CI when the workspace is not owned by the npm user.
How do I fix "npm ERR! Error: EACCES: permission denied, lstat '<path>'"?
npm cannot lstat a path (often a symlink or directory) because permissions block reading metadata. Fix ownership, remove bad symlinks, and run from user-writable filesystems.
What causes "npm ERR! Error: EACCES: permission denied, lstat '<path>'"?
Root-owned symlinks or directories from prior sudo installs Symlinks pointing into protected system/global locations NTFS/SMB mounts (WSL2, network shares) blocking lstat
Is the "npm ERR! Error: EACCES: permission denied, lstat '<path>'" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading