How to fix npm ERR! code ENOLOCK npm ERR! This command requires an existing lockfile in npm

npmBEGINNERHIGHUpdated Dec 5, 2025· 199 views

ENOLOCK occurs when npm commands cannot find a package-lock.json or npm-shrinkwrap.json file. Generate the lockfile by running npm install and commit it to version control.

Quick fix

Fixes ENOLOCK

pwd
ls -la | grep package.json
  1. Verify you're in the correct project directory
  2. Generate or regenerate package-lock.json
  3. Commit the lockfile to version control
  4. Check for npm config issues blocking lockfile creation
npm — error
pwd
ls -la | grep package.json
npm ERR! code ENOLOCK
npm ERR! This command requires an existing lockfile

What this error means

The ENOLOCK error occurs when npm commands (like `npm ci`, `npm audit fix`, or `npm install`) cannot find a package-lock.json or npm-shrinkwrap.json file in your project. This lockfile is essential for reproducing exact dependency versions across installations. Without it, npm cannot proceed with operations that require a locked dependency tree. The error is particularly common in CI/CD environments where the lockfile must be checked into version control.

Typical symptoms

  • npm ci fails immediately in CI/CD pipelines with ENOLOCK error
  • npm audit fix command exits with code ENOLOCK
  • Local development works (with npm install) but CI builds fail (with npm ci)
  • Docker builds fail at dependency installation step
  • Team members report different behavior when using different npm or Node.js versions

Common causes

  1. package-lock.json file is missing or not committed to git/version control
  2. Running npm commands in wrong directory that doesn't contain package.json
  3. Lockfile was deleted, ignored, or filtered out by .gitignore
  4. package-lock=false is set in .npmrc config file, preventing lockfile creation
  5. CI environment doesn't have the lockfile because it wasn't committed with the code
  6. Attempting npm audit fix on globally installed packages instead of project dependencies

How to fix "npm ERR! code ENOLOCK npm ERR! This command requires an existing lockfile"

1Verify you're in the correct project directory

Ensure you are in the directory containing your package.json file:

bash
pwd
ls -la | grep package.json

If package.json is not present, navigate to the correct project directory.

2Generate or regenerate package-lock.json

Create a fresh lockfile by running npm install:

bash
npm install

If you want to regenerate the lockfile without downloading all dependencies:

bash
npm install --package-lock-only

This is faster and only updates the lockfile based on package.json versions.

3Commit the lockfile to version control

The package-lock.json file must be committed to git so it's available in CI/CD:

bash
git add package-lock.json
git commit -m "Add package-lock.json"
git push

Verify it's tracked:

bash
git ls-files | grep package-lock.json

If it's not showing, check that package-lock.json is not in your .gitignore file.

4Check for npm config issues blocking lockfile creation

Verify that package-lock creation is not disabled in your npm config:

bash
npm config get package-lock
npm config get shrinkwrap

Both should return true. If either returns false, enable them:

bash
npm config set package-lock true
npm config set shrinkwrap true

Also check your .npmrc file for package-lock=false lines.

5For CI/CD: Ensure lockfile is present before running npm ci

In your CI configuration, use npm ci instead of npm install. Example GitHub Actions workflow:

yaml
- name: Install dependencies
  run: npm ci

If you get ENOLOCK in CI, verify the lockfile was committed:

bash
git log --all --full-history -- package-lock.json
6Fix package-lock mismatches in CI/CD environments

Ensure Node.js and npm versions match between local and CI:

bash
node --version
npm --version

Specify Node version in CI configs:

yaml
steps:
  - uses: actions/setup-node@v3
    with:
      node-version: '18'

If package-lock.json was created with a different npm major version, regenerate it locally and recommit.

Advanced notes

The ENOLOCK error exposes a critical aspect of npm's dependency management. When npm install runs, it generates package-lock.json to lock exact versions of all transitive dependencies. The npm ci command is more strict than npm install—it will fail rather than update the lockfile, making it ideal for CI/CD. If you're using different package managers (Yarn, pnpm), they require different lockfiles (yarn.lock, pnpm-lock.yaml) and won't work with package-lock.json.

Frequently asked questions

What does "ENOLOCK" mean?
json file in your project. This lockfile is essential for reproducing exact dependency versions across installations. Without it, npm cannot proceed with operations that require a locked dependency tree.
How do I fix "ENOLOCK"?
ENOLOCK occurs when npm commands cannot find a package-lock.json or npm-shrinkwrap.json file. Generate the lockfile by running npm install and commit it to version control.
What causes "ENOLOCK"?
package-lock.json file is missing or not committed to git/version control Running npm commands in wrong directory that doesn't contain package.json Lockfile was deleted, ignored, or filtered out by .gitignore
Is the "ENOLOCK" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading