This warning appears when npm publishes a package that lacks a 'repository' field in package.json. The repository field tells package consumers where the source code is hosted, improving discoverability and user trust.
Fixes npm WARN publish npm WARN publish No repository field
{
"name": "my-package",
"version": "1.0.0",
"repository": {
"type": "git",
"url": "https://github.com/username/my-package.git"
}
}{"name": "my-package","version": "1.0.0","repository": {"type": "git","url": "https://github.com/username/my-package.git"}}npm WARN publish npm WARN publish No repository field
This warning appears when npm publishes a package that lacks a 'repository' field in package.json. The repository field tells package consumers where the source code is hosted (e.g., GitHub, GitLab). While this warning doesn't prevent publication or installation, it degrades the package's discoverability and user trust. The field is informational but increasingly important for open-source packages where developers want to contribute or report issues. npm's registry metadata endpoint returns the repository field to consumers, enabling tools like GitHub dependency tracking and security scanners to trace vulnerabilities back to source.
Open package.json and add the repository field as an object:
{
"name": "my-package",
"version": "1.0.0",
"repository": {
"type": "git",
"url": "https://github.com/username/my-package.git"
}
}Replace 'username' with your GitHub username and 'my-package' with your repository name.
If you prefer concise syntax, use the shorthand format:
"repository": "github:username/my-package"
"repository": "gitlab:username/my-package"
"repository": "bitbucket:username/my-package"npm may auto-correct shorthand strings to the object format during publish.
If your package.json is in a subdirectory (monorepo structure), add the 'directory' property:
{
"repository": {
"type": "git",
"url": "https://github.com/username/monorepo.git",
"directory": "packages/my-package"
}
}This tells npm exactly where in the monorepo to find the package source.
Enhance package discoverability by adding related fields:
{
"bugs": {
"url": "https://github.com/username/my-package/issues"
},
"homepage": "https://github.com/username/my-package#readme",
"repository": { ... }
}These fields help users report issues and access documentation.
If this is not a public npm package, add "private": true instead:
{
"name": "my-app",
"version": "1.0.0",
"private": true
}This prevents accidental publishing and suppresses repository-related warnings.
For scoped packages: Repository information is particularly important as it establishes organizational identity and helps prevent typosquatting.
URL format preference: Use HTTPS URLs (https://github.com/...) for better firewall/corporate proxy compatibility rather than git:// URLs.
npm auto-correction: When publishing, npm normalizes repository URLs and may expand shorthand formats. Run npm pkg fix to apply these normalizations before publishing.
Security tooling: Many security scanning tools use the repository field to trace vulnerabilities back to source code, making it valuable for enterprise compliance.