how to fix npm audit error with loadVirtual and ENOLOCK?

Question

➜   npm audit
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file

I ran npm audit and got this error.

When I run below:

➜ npm config get package-lock
true

➜ npm config get shrinkwrap
true

Can anybody help with this? as to how to fix it? and npm audit fix --force is not working as well...

Solution 1

I just ran the command it says to.

npm i --package-lock-only

Then it showed me 0 vulnerabilities. Anyway, ran again audit fix and again 0 vulnerabilities.

Solution 2

works for me like this:

npm cache clean --force

npm fund

npm audit fix --force

Solution 3

That error tells you the root of the problem: This command requires an existing lockfile.. This implies that you don't already have a package-lock.json along side the package.json you're trying to audit. npm i --package-lock-only just generates/updates package-lock.json without reinstalling; npm i would reinstall and generate one (based on your config).

Solution 4

You need to create package-lock.json, run

npm install

then

npm audit fix

you won't have the problem

Solution 5

Try running these:

npm i --package-lock-only
npm config get package-lock
npm config get shrinkwrap
npm i --package-lock-only
npm audit fix

From here.

View more solutions

Comments

[jithil]

Try deleting package-lock.json

[Nicolas Garcia III]

Did you initialize npm in your project folder using npm init? After that, just type npm i --package-lock-only. Should see no err or vulnerabilities.

[Admin]

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.

[Abilogos]

what does npm fund do?

[musicman1979]

this resolved the warning of vulnerabilities for me. why does this happen? is it something that could be added to the install. i'm using this to install homebridge on ubuntu, fresh install, and am told there are problems immediately after the initial install. recommendations for bug reporting process?

[Paul D.]

this worked for me without the npm fund command