Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When running npm publish <package-spec>, where <package-spec> is a local file path, with allow-file=none or allow-file=root the process fails with the EALLOWFILE error code. This is closely related to #9755.

The reason I want to do this is because I want to run npm pack in one CI job, upload that as an artifact, and then download the artifact and publish in a separate CI job that has elevated permissions (where the first job has lower permissions).¹ I understand this doesn't protect the build of my package, but it does limit which software in general gets access to elevated privileges (which may be abused independently).

Expected Behavior

The --allow-file value does not affect publishing. Whether all, root, or none, publishing should go through.

Steps To Reproduce

mkdir allow-file-demo
cd allow-file-demo
npm install --global npm@12.2.0
npm init -y
npm pack 
echo '*** allow-file=none **'
echo 'allow-file=none' >.npmrc
npm publish --dry-run ./*.tgz || true
echo '*** allow-file=root **'
echo 'allow-file=root' >.npmrc
npm publish --dry-run ./*.tgz || true
echo '*** allow-file=all **'
echo 'allow-file=all' >.npmrc
npm publish --dry-run ./*.tgz || true

outputs

[...]
*** allow-file=none **
npm error code EALLOWFILE
npm error Fetching packages of type "file" have been disabled
npm error A complete log of this run can be found in: /root/.npm/_logs/2026-10-20T11_33_43_177Z-debug-0.log
*** allow-file=root **
npm error code EALLOWFILE
npm error Fetching non-root packages of type "file" have been disabled
npm error A complete log of this run can be found in: /root/.npm/_logs/2026-10-20T11_33_43_346Z-debug-0.log
*** allow-file=all **
npm notice
npm notice package: allow-file-demo@1.0.0
npm notice Tarball Contents
npm notice 215B package.json
npm notice Tarball Details
npm notice name: allow-file-demo
npm notice version: 1.0.0
npm notice filename: allow-file-demo-1.0.0.tgz
npm notice package size: 247 B
npm notice unpacked size: 215 B
npm notice shasum: 5afd77b5f6d1a4406850077729e56a3c27295c69
npm notice integrity: sha512-EU5AO2cXDVcXs[...]6CoDKaGxAoQdQ==
npm notice total files: 1
npm notice
npm warn publish This command requires you to be logged in to https://registry.npmjs.org/ (dry-run)
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access (dry-run)
+ allow-file-demo@1.0.0

Environment

• npm: 12.2.0
• Node.js: 26.3.0
• OS Name: Ubuntu 26.04.1 LTS
• System Model Name: Dell Inc. Latitude 7640
• npm config:

; "project" config from /shescape/.npmrc

allow-file = "none"
allow-git = "none"
allow-remote = "none"
audit = false
ignore-scripts = true
lockfile-version = "3"
min-release-age = 2
registry = "https://registry.npmjs.org/"
save-exact = true
save-prefix = ""

; node bin location = /usr/local/bin/node
; node version = v26.3.0
; npm local prefix = /shescape
; npm version = 12.2.0
; cwd = /shescape
; HOME = /root
; Run `npm config ls -l` to show all defaults.