NPM "typosquatting": terrible, unfriendly policy (Package name too similar to existing packages)

[paulmillr]

🏷️ Discussion Type

Bug

Body

I've tried to create a new package with a beautiful name. NPM blocked publish with error Package name too similar to existing packages. The package name is baler. The support told me they aren't able to override the decision because they don't have rights.

The suggested "publish in namespace" is too much friction and typing for users. Compare these two commands:

npx baler
npx @paulmillr/baler

First one is easy. Second is typing 3x more letters. First one looks more trusted than second one. It's like domains: compare baler.username.com vs baler.com.

This is idiotic. I'm not squatter. I maintain packages with 200M+ weekly downloads.

The policy makes NPM unfriendly for developers. GitHub is already losing graces of open-source people. So can NPM.

I think an ability to do per-case risk-focused review would be useful and would solve this problem. Or adjust your automatic system to at least rank devs with lots of trust.