[BUG] `npm fund` reports no packages, only one username

[lionkor]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

It only returns my username and exits

Expected Behavior

I see a list of packages looking for funding

Steps To Reproduce

1. I install a global package
2. I get told to run npm fund to see packages which need funding, of which there are supposedly 15.
3. I run npm fund
4. It only returns my username and exits

Environment

• npm: 11.19.0
• Node.js: v25.9.0
• OS Name: Windows 11
• System Model Name:
• npm config:

; "builtin" config from C:\Users\kortlepel\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = "C:\\Users\\kortlepel\\AppData\\Roaming\\npm"

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v25.9.0
; npm local prefix = C:\Users\kortlepel
; npm version = 11.19.0
; cwd = C:\Users\kortlepel\source\repos\smartgis\smartgis-server
; HOME = C:\Users\kortlepel
; Run `npm config ls -l` to show all defaults.

This also happens on my ArchLinux machine.

[lionkor]

Here's a screenshot showing that it tells me that I can run npm fund, including the part where it then doesn't work:

[MrDaPoyo]

I'm able to reproduce this issue on NPM version 12.0.2, Node v26.7.0 and an updated install of Arch Linux.

[lionkor]

It's only broken when run outside of a node project, but npm install -g tells me I can run it outside of a node project. When I run npm fund inside of a node project (so, next to a package.json), it works.

Running npm fund -g tells me EFUNDGLOBAL (which is triggered in ./lib/commands/fund.js:59), but this error is not triggered when running in an "implicitly" global context (if that makes sense).

Either way it should not tell me to run npm fund, either it should tell me to run npm fund -g or it should be fixed to auto-detect this, and then either way it should probably show me the funding info on global packages (as it clearly wants me to know about those).