[BUG] Invalid package name "-" with npm 11.8.0 #8929
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
With npm@11.8.0 we're no longer able to interact with the package -@0.0.1. Furthermore this module now appears to be missing from the npm registry website, even though the module is still there in the registry.
This has broken our CI pipelines as we use overrides of the form npm:-@0.0.1 to prevent certain modules from being installed.
Expected Behavior
npm can interact with the - package, e.g. with 11.7.0
$ ./11.7.0/node_modules/.bin/npm --version
11.7.0
$ ./11.7.0/node_modules/.bin/npm info -- -@0.0.1
-@0.0.1 | UNLICENSED | deps: none | versions: 1
> Created using https://github.com/parzh/create-package-typescript
dist
.tarball: https://registry.npmjs.org/-/-/--0.0.1.tgz
.shasum: db6db7cd866142880dd03e5b8781d1b4fac0e5bd
.integrity: sha512-3HfneK3DGAm05fpyj20sT3apkNcvPpCuccOThOPdzz8sY7GgQGe0l93XH9bt+YzibcTIgUAIMoyVJI740RtgyQ==
.unpackedSize: 600 B
maintainers:
- npm <npm@npmjs.com>
dist-tags:
latest: 0.0.1
published over a year ago by parzhitsky <parzhitsky@gmail.com>
Steps To Reproduce
Using npm@11.8.0 run npm info -- -@0.0.1
$ ./11.8.0/node_modules/.bin/npm --version
11.8.0
$ ./11.8.0/node_modules/.bin/npm info -- -@0.0.1
npm error code EINVALIDPACKAGENAME
npm error Invalid package name "-" of package "-@0.0.1": name cannot start with a hyphen.
npm error A complete log of this run can be found in: /Users/user/.npm/_logs/2026-01-23T11_27_46_901Z-debug-0.log
Environment
- npm: 11.8.0
- Node.js: 24.5.0
- OS Name: macOS
- System Model Name: MacBook Pro M1
- npm config:
$ ./11.8.0/node_modules/.bin/npm config ls
; node bin location = /opt/homebrew/Cellar/node/24.5.0/bin/node
; node version = v24.5.0
; npm local prefix = /private/tmp/tmp
; npm version = 11.8.0
; cwd = /private/tmp/tmp
; HOME = /Users/user
; Run `npm config ls -l` to show all defaults.