Fix: npm error code EALLOWREMOTE (and EALLOWGIT), tested

npm 12 stopped installing packages from anywhere but a registry unless you allow it. A dependency given as a tarball URL now fails with EALLOWREMOTE, and one from git fails with EALLOWGIT. npm 11 installed every one of them without a word.

You may not have chosen npm 12 on purpose. Node 26.13.0, the new LTS, still ships npm 11.20.0, but npm install -g npm now gives you 12.2.1, the version tagged latest.

I ran each case on npm 12.0.2, 12.1.0 and 12.2.1. All three behaved the same, and all three start with allow-remote and allow-git set to none:

> npm config get allow-remote
none

Which dependencies get which error

A GitHub link is not automatically “git”. The archive .tar.gz URL counts as remote, so it needs allow-remote, not allow-git. file: dependencies are untouched, because allow-file starts at all.

The EALLOWGIT version reads:

npm error code EALLOWGIT
npm error Fetching packages of type "git" have been disabled
npm error Refusing to fetch "is-odd@github:jonschlinkert/is-odd"

Your own package.json: allow root

When the URL or git link is in your own package.json, root is enough. It allows these sources for your direct dependencies, and nothing deeper.

allow-remote=root
allow-git=root

In CI, the environment variable did the same job without a file: NPM_CONFIG_ALLOW_REMOTE=root npm install installed on all three npm 12 versions.

“non-root packages”: a dependency of a dependency

When the URL belongs to one of your dependencies, root doesn’t help, and npm says so with one extra word:

npm error code EALLOWREMOTE
npm error Fetching non-root packages of type "remote" have been disabled
npm error Refusing to fetch "is-odd@https://registry.npmjs.org/is-odd/-/is-odd-3.0.1.tgz"

That’s what I got on every npm 12 version with the root setting from above, installing a package whose own package.json points at a tarball URL. If you see non-root, the setting is already working for your own dependencies, and the problem is deeper in the tree.

"overrides": {
  "is-odd": "3.0.1"
}

npm ci in CI: an old lockfile

This one catches CI first. I created a lockfile with npm 11.20.0 for a project with a tarball dependency. It records the URL as "resolved": "https://registry.npmjs.org/is-odd/-/is-odd-3.0.1.tgz". Then I ran npm ci on 12.2.1:

npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "is-odd@https://registry.npmjs.org/is-odd/-/is-odd-3.0.1.tgz"

A lockfile with only normal registry dependencies went through npm ci on 12.2.1 without errors. Every registry package has a resolved URL too; npm only refuses the ones that were declared as URLs.

allow-remote=root

npx with a URL

npx https://registry.npmjs.org/cowsay/-/cowsay-1.6.0.tgz hi failed with EALLOWREMOTE on every npm 12 version.

npx --allow-remote=root https://registry.npmjs.org/cowsay/-/cowsay-1.6.0.tgz hi

A misspelled setting fails quietly

Here the .npmrc and the flag behave differently. A typo in .npmrc, allow-remotes=root, only printed a warning, and the install still failed with EALLOWREMOTE:

npm warn Unknown project config "allow-remotes". This will stop working in the next major version of npm.
npm error code EALLOWREMOTE

The same typo as a flag, --allow-remotes=root, stopped npm 12 straight away with npm error code EUNKNOWNCONFIG. If you added the line and still get EALLOWREMOTE without the word “non-root”, look for that warning first.

How this was tested

Windows 11 Pro, Node 26.13.0 (the official zip, checksum checked against SHASUMS256.txt), on October 29, 2026. npm 11.20.0 is the copy bundled with Node 26.13.0. npm 12.0.2, 12.1.0 and 12.2.1 were installed side by side and run with that Node. Each case ran in a fresh folder against the public npm registry and GitHub, with no sign-in. The dependency-of-a-dependency case used a local package packed with npm pack, whose own dependency was a tarball URL. The scripts and the full output are public.