How to fix npm ERR! Error: EPERM: operation not permitted, scandir '<path>' in npm

npmBEGINNERMEDIUMUpdated Sep 4, 2026· 225 views

npm cannot list a directory because Windows/WSL or security tools block access. Remove locks, move to user-owned filesystems, fix ownership, and clean/reinstall.

Quick fix

Fixes npm ERR! Error: EPERM: operation not permitted, scandir '<path>'

ls -ld <path>
stat <path>
  1. Check the directory and ownership
  2. Release AV/IDE locks
  3. Use user-owned cache and prefix
  4. Move to a Linux/ext4 path or align container UID
npm — error
ls -ld <path>
stat <path>
npm ERR! Error: EPERM: operation not permitted, scandir '<path>'

What this error means

npm uses scandir to enumerate directories in node_modules, the cache, and global installs. On Windows/WSL, if AV/EDR holds a lock or the directory is on a restricted NTFS/SMB mount, scandir throws EPERM and npm stops. It commonly appears with VS Code/Defender watching node_modules, on WSL2 projects stored on /mnt/c, or in Docker/CI when running as a different user than the volume owner.

Typical symptoms

  • npm install/ci fails with EPERM: scandir '<path>'
  • Works as Administrator/elevated but not normally
  • Defender/AV alerts during install
  • node_modules or cache directories show root/Administrator ownership
  • Occurs more on WSL2/Windows paths than on Linux paths

Common causes

  1. Antivirus/Defender/EDR holding locks on directories
  2. VS Code or file watchers reading node_modules during install
  3. NTFS/SMB mounts (WSL2, network shares) denying directory reads
  4. Docker/CI user mismatch with volume ownership
  5. Leftover root-owned directories from prior sudo installs

How to fix "npm ERR! Error: EPERM: operation not permitted, scandir '<path>'"

1Check the directory and ownership
bash
ls -ld <path>
stat <path>
2Release AV/IDE locks

Close VS Code/terminals and add Defender/AV exclusions for the project and npm cache. Retry from a new shell.

3Use user-owned cache and prefix
bash
npm config set cache ~/.npm-cache
mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
export PATH="$HOME/.npm-global/bin:$PATH"
4Move to a Linux/ext4 path or align container UID

On WSL, work under ~/projects (ext4) instead of /mnt/c. In Docker, set --user to match host UID/GID or chown the bind mount.

5Clean and reinstall
bash
rm -rf node_modules package-lock.json
npm cache clean --force
npm ci

Advanced notes

Network shares may deny directory listing even when Windows shows read access; use a local clone for installs. Corporate macOS/Windows images sometimes mark node_modules as read-only during scans—scheduling installs outside scan windows or adding exclusions helps. In CI, clear caches copied from root-owned layers before npm ci to avoid EPERM on shared cache dirs.

Frequently asked questions

What does "npm ERR! Error: EPERM: operation not permitted, scandir '<path>'" mean?
npm uses scandir to enumerate directories in node_modules, the cache, and global installs. On Windows/WSL, if AV/EDR holds a lock or the directory is on a restricted NTFS/SMB mount, scandir throws EPERM and npm stops. It commonly appears with VS Code/Defender watching node_modules, on WSL2 projects stored on /mnt/c, or in Docker/CI when running as a different user than the volume owner.
How do I fix "npm ERR! Error: EPERM: operation not permitted, scandir '<path>'"?
npm cannot list a directory because Windows/WSL or security tools block access. Remove locks, move to user-owned filesystems, fix ownership, and clean/reinstall.
What causes "npm ERR! Error: EPERM: operation not permitted, scandir '<path>'"?
Antivirus/Defender/EDR holding locks on directories VS Code or file watchers reading node_modules during install NTFS/SMB mounts (WSL2, network shares) denying directory reads
Is the "npm ERR! Error: EPERM: operation not permitted, scandir '<path>'" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading