How to fix npm ERR! Invalid dependency: expected object but got string in npm

npmBEGINNERMEDIUMUpdated Dec 6, 2025· 170 views

This error occurs when npm encounters malformed dependency data during installation. The most common cause is a corrupted package-lock.json file or lockfile version mismatch between npm versions.

Quick fix

Fixes npm ERR! Invalid dependency: expected object but got string

# Remove lockfile and installed modules
rm -rf node_modules package-lock.json

# Reinstall from scratch
npm install
  1. Delete lockfile and node_modules
  2. Clear npm cache
  3. Unlink any linked packages
  4. Validate package.json dependencies
npm — error
# Remove lockfile and installed modules
rm -rf node_modules package-lock.json
# Reinstall from scratch
npm install
npm ERR! Invalid dependency: expected object but got string

What this error means

This error indicates that npm's dependency resolver received unexpected data types when processing your project's dependency tree. The installer expects dependency entries to be objects containing version information and metadata, but instead found string values. The underlying cause is typically a corrupted or incompatible package-lock.json file. This can happen when the lockfile was generated with a different npm version (particularly the transition between lockfileVersion 1 and 2), after using `npm link` for local development, or when the file becomes desynchronized from package.json through manual edits or failed installations.

Typical symptoms

  • npm install fails with EINVALIDTYPE error code
  • Error message includes "Argument #X: Expected object but got string"
  • Installation succeeds on first run but fails on subsequent runs
  • Issue appears after upgrading Node.js or npm versions
  • Occurs specifically with npm update after using npm link
  • CI/CD builds fail while local installation works

Common causes

  1. Corrupted package-lock.json with invalid reference structures
  2. Lockfile version mismatch between npm versions (lockfileVersion 0 vs 1 vs 2)
  3. Using npm link created inconsistent dependency tree
  4. Empty string dependencies like "" in package.json
  5. Node.js/npm version incompatibility with older npm versions
  6. Manual edits to package-lock.json corrupted the structure
  7. Failed prior installation left lockfile in inconsistent state

How to fix "npm ERR! Invalid dependency: expected object but got string"

1Delete lockfile and node_modules

The most reliable fix is to delete cached dependency state and rebuild:

bash
# Remove lockfile and installed modules
rm -rf node_modules package-lock.json

# Reinstall from scratch
npm install

This forces npm to rebuild the entire dependency tree from package.json.

2Clear npm cache

Remove potentially corrupted cached data:

bash
# Force clear the npm cache
npm cache clean --force

# Verify cache is clean
npm cache verify
3Unlink any linked packages

If you've used npm link for local development, unlink before installing:

bash
# List globally linked packages
npm ls -g --depth=0 --link=true

# Unlink specific package
npm unlink <package-name>

# Then reinstall
npm install
4Validate package.json dependencies

Check that all dependencies are properly formatted as semver strings:

json
{
  "dependencies": {
    "express": "^4.18.0",
    "lodash": "~4.17.21"
  }
}

Look for:
- Empty string values ("")
- Missing version strings
- Objects where strings are expected

5Upgrade Node.js and npm

Use LTS versions to avoid known dependency resolution bugs:

bash
# Check current versions
node -v
npm -v

# Upgrade npm to latest
npm install -g npm@latest

# Or use nvm to switch Node versions
nvm install --lts
nvm use --lts

Recommended: Node.js 18+ with npm 9+

6Try npm ci instead of npm install

For CI environments, use npm ci which is stricter about lockfile consistency:

bash
# Clean install from lockfile
npm ci

Note: npm ci requires package-lock.json to exist and match package.json exactly.

Advanced notes

This error is particularly common in CI/CD environments where the Node.js version on runners may differ from local development. Always commit package-lock.json to version control and ensure CI runners use the same Node.js major version as development.

For monorepos using npm workspaces, this error can occur when workspace packages reference each other incorrectly. Ensure workspace dependencies use the workspace: protocol or exact version matches.

Frequently asked questions

What does "npm ERR! Invalid dependency: expected object but got string" mean?
This error indicates that npm's dependency resolver received unexpected data types when processing your project's dependency tree. The installer expects dependency entries to be objects containing version information and metadata, but instead found string values. json file.
How do I fix "npm ERR! Invalid dependency: expected object but got string"?
This error occurs when npm encounters malformed dependency data during installation. The most common cause is a corrupted package-lock.json file or lockfile version mismatch between npm versions.
What causes "npm ERR! Invalid dependency: expected object but got string"?
Corrupted package-lock.json with invalid reference structures Lockfile version mismatch between npm versions (lockfileVersion 0 vs 1 vs 2) Using npm link created inconsistent dependency tree
Is the "npm ERR! Invalid dependency: expected object but got string" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading