NPM Package Name is blocked...

[doughmination]

🏷️ Discussion Type

Question

Body

Hey There!

So I can't seem to open a ticket on NPM about this, as it seems to be a edge case issue, but my package is not being allowed to be published

npm error code E403
npm error 403 403 Forbidden - PUT https://registry.npmjs.org/jpcl - Package name too similar to existing packages jscs,sjcl,psl; try renaming your package to '@doughmination-ceo/jpcl' and publishing with 'npm publish --access=public' instead
npm error 403 In most cases, you or one of your dependencies are requesting a package version that is forbidden by your security policy, or on a server you do not have access to.
npm error A complete log of this run can be found in: C:\Users\clove\AppData\Local\npm-cache_logs\2026-09-19T16_11_34_221Z-debug-0.log

Any way I can raise this to npm and get it resolved, as I don't want to rename my package, thanks

EDIT: I just opened a general support ticket, not sure if this is the correct direction, but we can pray.

[rajesh0974]

This looks like npm's server-side package-name similarity/typosquatting check rather than a normal npm permission error.

npm publish --dry-run or checking whether the package name appears available doesn't necessarily guarantee that the registry will accept the name, because the final similarity check happens when publishing.

Since you want to keep jpcl, I'd contact npm Support and request a manual review of the name. In your request, explain that jpcl is an independently developed package, that you're not attempting to impersonate or typosquat an existing package, and explain why you specifically need the unscoped name.

npm's support page has a "Dispute a package, org, or username" option:
https://www.npmjs.com/support

The alternative npm is explicitly suggesting is a scoped package such as:

@doughmination-ceo/jpcl

followed by:

npm publish --access=public

But if keeping the unscoped jpcl name is important, I'd request the manual review first rather than trying to bypass the registry check.

[doughmination]

npm's support page has a "Dispute a package, org, or username" option

No it doesn't, I did check lol.

I'll see if I can open a ticket regardless

[rajesh0974]

You're right, my mistake I checked again and that specific option isn't there.
Thanks for pointing it out.

Opening a general npm support ticket sounds like the right approach. Hopefully they can review the package-name restriction or direct you to the appropriate team.

[rajesh0794]

This error is coming from npm's package-name similarity protection. The registry has detected jpcl as being too similar to existing package names.

If you want to keep the unscoped jpcl name, I would contact npm Support and request a review rather than trying to bypass the restriction.

You can submit the request here: https://www.npmjs.com/support

Explain that the package is your own project and that you're not trying to imitate or impersonate any of the existing packages. Include the exact E403 error and your package details so they can review the name.

If npm doesn't approve the name, the supported alternative is to publish it under your scope:

@doughmination-ceo/jpcl

with:

npm publish --access=public

[Dani-8]

@doughmination The E403 error you are seeing is triggered by npm's automated server-side typosquatting protection (squatting filter). When publishing an unscoped package name that is very short or mechanically similar to popular packages (in your case, jscs, sjcl, and psl), npm automatically blocks the PUT request to protect consumers from supply-chain attacks.

Here is how you can resolve this depending on how you want to proceed:

1. Directly Contacting npm Support for Unscoped Approval

Since you submitted a general support ticket, you are on the right track! To speed up the review:

• Email Support Directly: You can also send an email to support@npmjs.com or abuse@npmjs.com referencing your ticket ID.
• Information to Include:
• State that jpcl is an original project and not an attempt to typosquat or impersonate jscs, sjcl, or psl.
• Attach the full npm-debug.log output showing the E403 403 Forbidden response.
• Request a manual whitelist/override for the jpcl package name under your npm user account.

Note: npm support reviews unscoped name disputes manually, which can take a few business days.

---

2. Immediate Workaround: Publish as a Scoped Package

If you cannot wait for npm support to manually approve the unscoped name, publish under your user scope as suggested by the CLI error:

1. Update package.json:

{
  "name": "@doughmination-ceo/jpcl"
}

2. Run the publish command with public access explicit flag:

npm publish --access=public

Scoped packages bypass the global unscoped typosquatting filter because the @scope/ prefix explicitly identifies your account as the namespace owner.

[MoheyElbaz]

The suggestion to ask for a manual review is right, but I would not block on it — and there is a good chance you do not actually need the unscoped name to get what you want.

If the reason you want jpcl is that you want people to type jpcl, a scope costs you nothing. The command name comes from the bin field, not from the package name, and the two are completely independent:

{
  "name": "@doughmination/jpcl",
  "bin": { "jpcl": "bin/cli.js" }
}

Install that and users run jpcl. Nothing in the command they type reveals the scope. @angular/cli ships its binary as ng on exactly this mechanism, and it is the normal arrangement rather than a workaround. So if the CLI ergonomics were the concern, you can publish today and stop waiting.

I would also set expectations on the review. Four characters against jscs, sjcl and psl is not an edge case — it is the expected result. Short unscoped names sit within a one or two character edit distance of a large number of existing packages just by virtue of being short, so the similarity check fires on almost anything in that length range. npm's own name guidelines ask that a name not be "spelled in a similar way to another package name", which means the block is the policy working, not a bug to be escalated. That does not make your package a typosquat, but it does mean the reviewer is being asked to carve out an exception to a rule that exists because the alternative was a supply-chain problem. Those get declined more often than granted.

If you would rather stay unscoped, lengthen rather than argue. A distinctive name of seven or eight characters clears the check comfortably and is easier for people to find, which is the thing an unscoped name was supposed to buy you in the first place.

[Dani-8]

@MoheyElbaz Excellent callout on the bin field configuration!

Pointing out that binary executable names are decoupled from @scope/package-name is crucial here—especially for CLI tools, as using @scope/jpcl with "bin": { "jpcl": "..." } gives users the exact same short terminal command (jpcl) while bypassing npm's automated short-name squatting filters entirely.

Adding the context around npm's edit-distance policy for 4-character names also manages expectations nicely regarding support ticket approval odds.