npmpackage.info

Gathering detailed insights and metrics for validate-npm-package-name

Other packages similar to validate-npm-package-name

is-scoped

3.0.0

Check if a string is a scoped npm package name

@types/validate-npm-package-name

4.0.2

TypeScript definitions for validate-npm-package-name

package-name-regex

4.0.3

Provides a regex that can be used to test if a string is a valid NPM package name.

inquirer-npm-name

4.0.0

Helper function using inquirer to validate a value provided in a prompt does not exist as an npm package.

Gathering detailed insights and metrics for validate-npm-package-name

validate-npm-package-name - 6.0.1 | npmpackage.info

validate-npm-package-name

Is the given string an acceptable npm package name?

6.0.1

303

ISC

JavaScript

7.71 kB

6.4

Installations

npm install validate-npm-package-name

Developer Guide

BETA

Typescript

No

Module System

CommonJS

Min. Node Version

^18.17.0 || >=20.5.0

Node Version

22.16.0

NPM Version

11.4.1 Pull Requests

Open

1

Total

112

Closed

55

Merged

56

Issues

Open

4

Total

26

Closed

22

Releases

v6.0.1

Updated on Jun 05, 2025

v6.0.0

Updated on Sep 25, 2024

v5.0.1

Updated on May 06, 2024

v5.0.0

Updated on Oct 14, 2022

v4.0.0

Updated on Mar 29, 2022

View All 5 releases

Languages

JavaScript

JavaScript (100%)

Developer

npm

Download Statistics

Total Downloads

Last Day

Last Week

Last Month

Last Year

GitHub Statistics

ISC License

303 Stars

118 Commits

48 Forks

25 Watchers

1 Branches

81 Contributors

Updated on Jul 09, 2025

Maintainers

View All 81 Contributors

Package Meta Information

Latest Version

6.0.1

Package Id

validate-npm-package-name@6.0.1

Unpacked Size

7.71 kB

Size

3.15 kB

File Count

NPM Version

11.4.1

Node Version

22.16.0

Published on

Jun 05, 2025

Total Downloads

Cumulative downloads

Total Downloads

NaN

Last Day

NaN

Compared to previous day

Last Week

NaN

Compared to previous week

Last Month

NaN

Compared to previous month

Last Year

NaN

Compared to previous year

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

@npmcli/eslint-config @npmcli/template-oss tap

validate-npm-package-name

Give me a string and I'll tell you if it's a valid npm package name.

This package exports a single synchronous function that takes a string as input and returns an object with two properties:

validForNewPackages :: Boolean
validForOldPackages :: Boolean

Naming rules
Examples
- Valid Names
- Invalid Names
Legacy Names
Tests
License

Naming Rules

Below is a list of rules that valid npm package name should conform to.

package name length should be greater than zero
all the characters in the package name must be lowercase i.e., no uppercase or mixed case names are allowed
package name can consist of hyphens
package name must not contain any non-url-safe characters (since name ends up being part of a URL)
package name should not start with . or _
package name should not contain any spaces
package name should not contain any of the following characters: ~)('!*
package name cannot be the same as a node.js/io.js core module nor a reserved/blacklisted name. For example, the following names are invalid:
- http
- stream
- node_modules
- favicon.ico
package name length cannot exceed 214

Examples

Valid Names

1var validate = require("validate-npm-package-name")
2
3validate("some-package")
4validate("example.com")
5validate("under_score")
6validate("123numeric")
7validate("@npm/thingy")
8validate("@jane/foo.js")

All of the above names are valid, so you'll get this object back:

1{
2  validForNewPackages: true,
3  validForOldPackages: true
4}

Invalid Names

1validate("excited!")
2validate(" leading-space:and:weirdchars")

That was never a valid package name, so you get this:

1{
2  validForNewPackages: false,
3  validForOldPackages: false,
4  errors: [
5    'name cannot contain leading or trailing spaces',
6    'name can only contain URL-friendly characters'
7  ]
8}

Legacy Names

In the old days of npm, package names were wild. They could have capital letters in them. They could be really long. They could be the name of an existing module in node core.

If you give this function a package name that used to be valid, you'll see a change in the value of validForNewPackages property, and a warnings array will be present:

1validate("eLaBorAtE-paCkAgE-with-mixed-case-and-more-than-214-characters-----------------------------------------------------------------------------------------------------------------------------------------------------------")

returns:

1{
2  validForNewPackages: false,
3  validForOldPackages: true,
4  warnings: [
5    "name can no longer contain capital letters",
6    "name can no longer contain more than 214 characters"
7  ]
8}

Tests

1npm install
2npm test

License

ISC

No vulnerabilities found.

10

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Security-Policy

Determines if the project has published a security policy.

10

License

Determines if the project has defined a license.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

7

SAST

Determines if the project uses static code analysis.

4

Maintained

Determines if the project is "actively maintained".

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/audit.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/audit.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci-release.yml:132: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/ci-release.yml:148: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci-release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/ci.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/codeql-analysis.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/post-dependabot.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/post-dependabot.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/pull-request.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/pull-request.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-integration.yml:45: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release-integration.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:218: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:236: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:275: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:284: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:304: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:66: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:76: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:119: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:136: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/release.yml:199: update your workflow using https://app.stepsecurity.io/secureworkflow/npm/validate-npm-package-name/release.yml/main?enable=pin
Warn: npmCommand not pinned by hash: .github/workflows/audit.yml:41
Warn: npmCommand not pinned by hash: .github/workflows/ci-release.yml:62
Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:45
Warn: npmCommand not pinned by hash: .github/workflows/post-dependabot.yml:39
Warn: npmCommand not pinned by hash: .github/workflows/pull-request.yml:45
Warn: npmCommand not pinned by hash: .github/workflows/release-integration.yml:56
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:50
Warn: npmCommand not pinned by hash: .github/workflows/release.yml:130
Info: 0 out of 26 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 12 third-party GitHubAction dependencies pinned
Info: 0 out of 8 npmCommand dependencies pinned

0

Fuzzing

Determines if the project uses fuzzing.

Score

6.4

/10

Last Scanned on 2025-07-07

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More

Other packages similar to validate-npm-package-name

Other packages similar to validate-npm-package-name

validate-npm-package-name

Installations

Developer Guide

No

CommonJS

^18.17.0 || >=20.5.0

22.16.0

11.4.1

Pull Requests

1

112

55

56

Issues

4

26

22

Releases

Languages

Developer

Download Statistics

GitHub Statistics

Maintainers

Package Meta Information

Total Downloads

NaN

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dev Dependencies

validate-npm-package-name

Contents

Naming Rules

Examples

Valid Names

Invalid Names

Legacy Names

Tests

License

10

10

10

10

10

10

7

4

0

0

0

0

6.4

/10