How to fix npm ERR! This package has been marked as private in npm

npmBEGINNERLOWUpdated Dec 6, 2025· 206 views

The EPRIVATE error occurs when attempting to publish a package that has "private": true in package.json. This is a safety feature to prevent accidental publication of internal code.

Quick fix

Fixes npm ERR! This package has been marked as private

{
  "name": "my-package",
  "version": "1.0.0",
  "private": false
}
  1. Remove or disable the private field
  2. Use --access public for scoped packages
  3. Add publishConfig to package.json
  4. Verify authentication
npm — error
{
  "name": "my-package",
  "version": "1.0.0",
  "private": false
}
npm ERR! This package has been marked as private

What this error means

The EPRIVATE error is npm's safeguard against accidentally publishing private or internal packages to the public registry. When package.json contains `"private": true`, npm refuses to publish the package to any registry. This is distinct from npm's paid private packages feature. The `private` field in package.json means "never publish this package anywhere"—it's commonly used for application repositories, internal tools, and monorepo root packages that should never be distributed as npm packages.

Typical symptoms

  • npm publish fails with EPRIVATE error code
  • Error message says "Remove the private field from package.json to publish it"
  • CI/CD pipelines fail during automated package releases
  • Scoped packages fail even without explicit private field
  • Publishing to private registries also blocked
  • Confusion between npm private and GitHub private repositories

Common causes

  1. "private": true explicitly set in package.json
  2. Scoped packages default to restricted access without --access public
  3. Package was never intended to be published (application code)
  4. Monorepo root package mistakenly being published instead of sub-package
  5. Missing publishConfig.access setting for scoped packages
  6. Copied package.json from private project without removing private field

How to fix "npm ERR! This package has been marked as private"

1Remove or disable the private field

Edit package.json to remove the private restriction:

json
{
  "name": "my-package",
  "version": "1.0.0",
  "private": false
}

Or simply remove the "private" field entirely—packages are public by default.

2Use --access public for scoped packages

Scoped packages (@username/package) default to restricted. Make them public explicitly:

bash
# Publish scoped package as public
npm publish --access public

This is required even if the private field is not set.

3Add publishConfig to package.json

Persist the access setting for future publishes:

json
{
  "name": "@myorg/my-package",
  "version": "1.0.0",
  "publishConfig": {
    "access": "public"
  }
}

This eliminates the need to pass --access public every time.

4Verify authentication

Ensure you're logged in with proper permissions:

bash
# Check current login
npm whoami

# Re-authenticate if needed
npm logout
npm login

# Verify email is confirmed
npm profile get
5Check if publishing to correct package

In monorepos, ensure you're in the correct directory:

bash
# Check current package name
cat package.json | grep '"name"'

# Navigate to correct package directory
cd packages/my-publishable-package
npm publish

The root package.json often has private: true intentionally.

6Configure for private registry

If publishing to a private registry (not npm public), configure the registry:

json
{
  "name": "@myorg/my-package",
  "publishConfig": {
    "registry": "https://npm.pkg.github.com"
  }
}

Note: The private: true field still blocks publishing to ANY registry, including private ones.

Advanced notes

The private field serves different purposes in different contexts. For application repositories (websites, APIs, CLI tools that aren't distributed via npm), setting "private": true is a best practice that prevents accidental publication.

For monorepos, the root package.json should have "private": true while publishable sub-packages should not. Tools like Lerna and Turborepo handle this automatically.

In CI/CD, always include --access public in publish commands for scoped packages, or use publishConfig in package.json. Environment variable NPM_TOKEN must have publish permissions for the scope.

Frequently asked questions

What does "npm ERR! This package has been marked as private" mean?
The EPRIVATE error is npm's safeguard against accidentally publishing private or internal packages to the public registry. json contains "private": true, npm refuses to publish the package to any registry. This is distinct from npm's paid private packages feature.
How do I fix "npm ERR! This package has been marked as private"?
The EPRIVATE error occurs when attempting to publish a package that has "private": true in package.json. This is a safety feature to prevent accidental publication of internal code.
What causes "npm ERR! This package has been marked as private"?
"private": true explicitly set in package.json Scoped packages default to restricted access without --access public Package was never intended to be published (application code)
Is the "npm ERR! This package has been marked as private" error serious?
It is a low-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading