npmpackage.info

Gathering detailed insights and metrics for validate-npm-package-name

Other packages similar to validate-npm-package-name

is-scoped

3.0.0

Check if a string is a scoped npm package name

@types/validate-npm-package-name

4.0.2

TypeScript definitions for validate-npm-package-name

package-name-regex

4.0.0

Provides a regex that can be used to test if a string is a valid NPM package name.

inquirer-npm-name

4.0.0

Helper function using inquirer to validate a value provided in a prompt does not exist as an npm package.

Gathering detailed insights and metrics for validate-npm-package-name

validate-npm-package-name - 6.0.0 | npmpackage.info

validate-npm-package-name

Is the given string an acceptable npm package name?

6.0.0

301

ISC

JavaScript

763.00 B

2,391,769,361 6.1

Installations

npm install validate-npm-package-name

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

^18.17.0 || >=20.5.0

Node Version

22.9.0

NPM Version

10.8.3 Score

99.8

Supply Chain

100

Quality

82.9

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

1

Total

107

Closed

54

Merged

52

Issues

Open

4

Total

25

Closed

21

Releases

v6.0.0

Updated on Sep 25, 2024

v5.0.1

Updated on May 06, 2024

v5.0.0

Updated on Oct 14, 2022

v4.0.0

Updated on Mar 29, 2022

View All 4 releases

Languages

JavaScript

JavaScript (100%)

Developer

npm

Download Statistics

Total Downloads

2,391,769,361

Last Day

3,564,453

Last Week

18,843,513

Last Month

76,958,877

Last Year

787,002,921

GitHub Statistics

ISC License

301 Stars

113 Commits

46 Forks

26 Watchers

1 Branches

78 Contributors

Updated on May 04, 2025

Bundle Size

1.57 kB

Minified

763.00 B

Minified + Gzipped

Bundlephobia

Maintainers

View All 78 Contributors

Package Meta Information

Latest Version

6.0.0

Package Id

validate-npm-package-name@6.0.0

Unpacked Size

7.61 kB

Size

3.12 kB

File Count

NPM Version

10.8.3

Node Version

22.9.0

Published on

Sep 25, 2024

Total Downloads

Cumulative downloads

Total Downloads

2,391,769,361

Last Day

1.1%

3,564,453

Compared to previous day

Last Week

11.7%

18,843,513

Compared to previous week

Last Month

1.8%

76,958,877

Compared to previous month

Last Year

33.1%

787,002,921

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@npmcli/eslint-config @npmcli/template-oss tap

validate-npm-package-name

Give me a string and I'll tell you if it's a valid npm package name.

This package exports a single synchronous function that takes a string as input and returns an object with two properties:

validForNewPackages :: Boolean
validForOldPackages :: Boolean

Naming rules
Examples
- Valid Names
- Invalid Names
Legacy Names
Tests
License

Naming Rules

Below is a list of rules that valid npm package name should conform to.

package name length should be greater than zero
all the characters in the package name must be lowercase i.e., no uppercase or mixed case names are allowed
package name can consist of hyphens
package name must not contain any non-url-safe characters (since name ends up being part of a URL)
package name should not start with . or _
package name should not contain any spaces
package name should not contain any of the following characters: ~)('!*
package name cannot be the same as a node.js/io.js core module nor a reserved/blacklisted name. For example, the following names are invalid:
- http
- stream
- node_modules
- favicon.ico
package name length cannot exceed 214

Examples

Valid Names

1var validate = require("validate-npm-package-name")
2
3validate("some-package")
4validate("example.com")
5validate("under_score")
6validate("123numeric")
7validate("@npm/thingy")
8validate("@jane/foo.js")

All of the above names are valid, so you'll get this object back:

1{
2  validForNewPackages: true,
3  validForOldPackages: true
4}

Invalid Names

1validate("excited!")
2validate(" leading-space:and:weirdchars")

That was never a valid package name, so you get this:

1{
2  validForNewPackages: false,
3  validForOldPackages: false,
4  errors: [
5    'name cannot contain leading or trailing spaces',
6    'name can only contain URL-friendly characters'
7  ]
8}

Legacy Names

In the old days of npm, package names were wild. They could have capital letters in them. They could be really long. They could be the name of an existing module in node core.

If you give this function a package name that used to be valid, you'll see a change in the value of validForNewPackages property, and a warnings array will be present:

1validate("eLaBorAtE-paCkAgE-with-mixed-case-and-more-than-214-characters-----------------------------------------------------------------------------------------------------------------------------------------------------------")

returns:

1{
2  validForNewPackages: false,
3  validForOldPackages: true,
4  warnings: [
5    "name can no longer contain capital letters",
6    "name can no longer contain more than 214 characters"
7  ]
8}

Tests

1npm install
2npm test

License

ISC

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Security-Policy

Determines if the project has published a security policy.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

License

Determines if the project has defined a license.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

8

SAST

Determines if the project uses static code analysis.

0

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:112: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:128: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:144: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:89: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:236: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:274: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:283: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:303: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/audit.yml:38
Warn: npmCommand not pinned by hash: .github/workflows/ci-release.yml:58
Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/post-dependabot.yml:39
Warn: npmCommand not pinned by hash: .github/workflows/pull-request.yml:42
Warn: npmCommand not pinned by hash: .github/workflows/release-integration.yml:52
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:50
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:130
Info: 0 out of 26 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 12 third-party GitHubAction dependencies pinned
Info: 0 out of 8 npmCommand dependencies pinned

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Fuzzing

Determines if the project uses fuzzing.

Score

6.1

/10

Last Scanned on 2025-05-05

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to validate-npm-package-name

Other packages similar to validate-npm-package-name

validate-npm-package-name

Installations

Developer Guide

No

CommonJS

^18.17.0 || >=20.5.0

22.9.0

10.8.3

Score

Pull Requests

1

107

54

52

Issues

4

25

21

Releases

Languages

Developer

Download Statistics

GitHub Statistics

Bundle Size

1.57 kB

763.00 B

Maintainers

Package Meta Information

Total Downloads

2,391,769,361

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

validate-npm-package-name

Contents

Naming Rules

Examples

Valid Names

Invalid Names

Legacy Names

Tests

License

10

10

10

10

10

10

8

0

0

0

0

0

6.1

/10