Is That Package Name Really Free? How Registries Decide Who Gets a Name

What does a registry compare when you claim a name?

None of the three big registries compares your name letter for letter. Each one rewrites it first, and two names that end up the same after the rewrite count as one name.

npm's similarity check goes further than punctuation. Its own guidelines ask that an unscoped name "is not spelled in a similar way to another package name" (npm Docs, package name guidelines), and the npm docs do not describe how the check works.

What are the name rules on npm, PyPI and crates.io?

The format rules decide whether a name can exist at all; the last three rows decide whether you can have it. Each cell comes from the registry's own documentation, linked under the table.

Sources. npm: package.json docs, validate-npm-package-name, moniker rules, Username Policy. PyPI: names and normalization, Choosing a Project Name, Name Retention. crates.io: Cargo manifest format, registry index, crates.io policies.

What does a too-similar refusal look like?

On 12 June 2026 a release workflow published a scoped package fine, then failed on a new unscoped launcher named fit-map. The maintainers recorded the registry's answer in a public GitHub issue:

npm error 403 403 Forbidden - PUT https://registry.npmjs.org/fit-map - Package name
too similar to existing package is-map; try renaming your package to
'@dickolsson/fit-map' and publishing with 'npm publish --access=public' instead

Three things stand out. fit-map and is-map differ in letters, not only in punctuation, so the check is wider than the 2017 rule. The name did not exist on the registry, so a registry lookup said it was free. And the registry itself pointed to the way out: the same name under the publisher's scope.

The rule is also why some old names look like exceptions. reactnative is still on the registry, with a first publish date of 5 March 2015; npm's rule covers new packages only, "a package that has not been in the registry before", so names that came first stay.

How do you check a package name from the command line?

These lookups need no account. Each answers one question, and the comments say which. The 404 for json.stream is real (checked 24 October 2026), and still npm's 2017 post names it as a name no one can publish.

# npm: 404 means no package has exactly this name.
# It does not run the similarity check that the first publish runs.
curl -s -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/json.stream

# npm: format rules, with the validator library the npm team maintains.
# json.stream passes; JSON.stream fails for new packages (capital letters).
npm install --no-save validate-npm-package-name
node -e 'console.log(require("validate-npm-package-name")(process.argv[1]))' JSON.stream

# PyPI: the JSON API answers for the normalized name too
curl -sL -o /dev/null -w "%{http_code}\n" https://pypi.org/pypi/Python.Dateutil/json

# crates.io: the API answers for the - and _ variant of a taken name
curl -s -A "name-check ([email protected])" https://crates.io/api/v1/crates/serde-json | head -c 200

# Normalize a name the PyPI way before you compare it with anything
python3 -c 'import re,sys; print(re.sub(r"[-_.]+", "-", sys.argv[1]).lower())' Friendly.Bard

crates.io asks API clients for at most one request per second and a User-Agent that identifies the application (crates.io data access policy); put your own contact in place of the example. No public endpoint runs npm's similarity check before you publish, which is what issue 9188 asks for.

Which beliefs about free names are wrong?

In what order should you check a new name?

Cheapest checks first, and nothing public until the last one passes. A rename after launch costs more than any of these steps.

1. Run the format rules for every registry you will publish to

   A name that is valid on PyPI can fail on crates.io (a leading digit) or on npm (an uppercase letter).

2. Normalize the name the way each registry does, then look it up

   Use the commands above. A 200 for any variant means the name is taken.

3. Decide whether you need an unscoped npm name at all

   npm's guidelines put the similarity rule on unscoped names, and a scope "allows you to create a package with the same name as a package created by another user or organization" (npm Docs, About scopes). Scoped packages are private by default, so the first public publish needs --access public.

4. Check the GitHub user or organization name

   GitHub names are "first-come, first-served", and "accounts with no visible activity may be in active use" (GitHub Username Policy).

5. Look up the domain

   ICANN Lookup shows whether a domain is registered and by which registrar.

6. Search trademarks in the markets you sell to

   USPTO trademark search for the United States, TMview for the EU and its partner offices, WIPO Global Brand Database for international filings. A search is not legal advice; it finds the obvious conflicts early.

7. Publish a working first version

   On npm, only this step runs the similarity check. Publish something that installs and runs, so the name is used, not squatted.

Questions developers ask about package names