How to fix npm ERR! code EINVALIDPACKAGENAME npm ERR! Invalid package name: name is a core module name in npm

npmBEGINNERLOWUpdated Dec 6, 2025· 104 views

The EINVALIDPACKAGENAME error for core modules occurs when your package name matches a Node.js built-in module like 'fs', 'http', or 'path'. Rename your package to avoid conflicts with Node.js internals.

Quick fix

Fixes EINVALIDPACKAGENAME

assert, buffer, child_process, cluster, console, constants,
crypto, dgram, dns, domain, events, fs, http, http2, https,
inspector, module, net, os, path, perf_hooks, process,
punycode, querystring, readline, repl, stream, string_decoder,
timers, tls, tty, url, util, v8, vm, worker_threads, zlib
  1. Check Node.js core modules list
  2. Rename your package
  3. Use a scoped package name
  4. Check for corrupted dependencies
npm — error
assert, buffer, child_process, cluster, console, constants,
crypto, dgram, dns, domain, events, fs, http, http2, https,
inspector, module, net, os, path, perf_hooks, process,
punycode, querystring, readline, repl, stream, string_decoder,
timers, tls, tty, url, util, v8, vm, worker_threads, zlib
npm ERR! code EINVALIDPACKAGENAME
npm ERR! Invalid package name: name is a core module name

What this error means

This error occurs when you try to create or install a package with a name that matches a Node.js core module. Names like 'fs', 'http', 'path', 'util', 'events', 'stream', 'crypto', and other built-in modules are reserved. npm blocks these names to prevent confusion and potential security issues. If you could publish a package named 'fs', users might accidentally install it instead of using the built-in module, leading to unexpected behavior or malicious code execution. The validation happens both when publishing to npm and when npm parses package.json files during installation.

Typical symptoms

  • npm publish fails with 'name is a core module name' error
  • npm install fails when package.json has a core module name
  • Error during npm init if you choose a reserved name
  • CI/CD pipeline fails at package validation step
  • Cannot create new project with certain common names
  • Corrupted package-lock.json references core module names

Common causes

  1. Package name in package.json matches Node.js core module
  2. Accidentally named project after a common module (http, fs, path)
  3. Corrupted package-lock.json contains invalid references
  4. Typo in dependency name that matches a core module
  5. Old package with legacy name that's now reserved

How to fix "npm ERR! code EINVALIDPACKAGENAME npm ERR! Invalid package name: name is a core module name"

1Check Node.js core modules list

Node.js reserves these module names (partial list):

bash
assert, buffer, child_process, cluster, console, constants,
crypto, dgram, dns, domain, events, fs, http, http2, https,
inspector, module, net, os, path, perf_hooks, process,
punycode, querystring, readline, repl, stream, string_decoder,
timers, tls, tty, url, util, v8, vm, worker_threads, zlib

If your package name matches any of these, you need to rename it.

2Rename your package

Change the name in your package.json to something unique:

json
{
  "name": "my-http-utils"
}

Good naming strategies:
- Add a prefix: my-fs, acme-http
- Add a suffix: fs-extra, path-utils
- Use a scoped name: @yourname/fs
- Use a more descriptive name: file-system-helpers

3Use a scoped package name

Scoped names allow you to use otherwise reserved words:

json
{
  "name": "@yourcompany/http"
}

The scope (@yourcompany/) makes the name unique, even if 'http' alone would be invalid.

For public scoped packages, publish with:

bash
npm publish --access public
4Check for corrupted dependencies

If the error appears during install, check package-lock.json for invalid entries:

bash
# Search for suspicious entries
grep -E '"(fs|http|path|util)":' package-lock.json

If found, delete the lock file and reinstall:

bash
rm package-lock.json
npm install
5Validate your package name

Before publishing, validate your name:

bash
npx validate-npm-package-name "your-package-name"

This tool checks all npm naming rules and tells you exactly what's wrong if the name is invalid.

Advanced notes

The list of reserved names grows with each Node.js version as new core modules are added. For example, worker_threads was added in Node.js 10.5.0.

Some packages published before these restrictions exist with core module names. npm doesn't retroactively remove them, but you cannot publish new packages with these names.

If you're building a polyfill or compatibility layer for a core module, the convention is to use names like:
- readable-stream (for stream polyfill)
- path-browserify (for browser compatibility)
- buffer (special case - this one was grandfathered)

For tools that need to intercept or mock core modules (like testing frameworks), use runtime techniques rather than trying to publish packages with core module names.

Frequently asked questions

What does "EINVALIDPACKAGENAME" mean?
js core module. Names like 'fs', 'http', 'path', 'util', 'events', 'stream', 'crypto', and other built-in modules are reserved. npm blocks these names to prevent confusion and potential security issues.
How do I fix "EINVALIDPACKAGENAME"?
The EINVALIDPACKAGENAME error for core modules occurs when your package name matches a Node.js built-in module like 'fs', 'http', or 'path'. Rename your package to avoid conflicts with Node.js internals.
What causes "EINVALIDPACKAGENAME"?
Package name in package.json matches Node.js core module Accidentally named project after a common module (http, fs, path) Corrupted package-lock.json contains invalid references
Is the "EINVALIDPACKAGENAME" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading