npm / npm/cli

[BUG] npm publish --dry-run should detect name similarity conflicts before actual publish

Open
#9,188 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Priority Backlog
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

Current behavior
This has bugged me for a while, npm view returns 404 (name is free). npm publish --dry-run completes successfully. But npm publish fails with:
npm error code E403
npm error 403 Forbidden - Package name too similar to existing package

Why this matters
By the time the 403 hits, the developer has already:
Named their GitHub repo
Written the README
Potentially published blog posts or shared links

The current UX creates a false sense of safety. --dry-run explicitly promises to do "everything publish would do except actually publishing" — but it skips the one check that matters most for a new package.
Suggested fix
Run the similarity check as part of npm publish --dry-run and surface it as a warning or error before the actual publish attempt.

If nobodys willing to fix this, Ill take this up, since I believe this was raised earlier as well, but nothing was implemented.

Expected Behavior

Either npm publish --dry-run should run the similarity check and surface the conflict early, or npm view / the registry API should expose a dedicated endpoint to check name similarity so developers can verify before building, creating a GitHub repo, or writing any code.

Steps To Reproduce
Environment
  • npm: 11.9.0
  • Node.js: 24.14.0
  • OS Name: Ubuntu

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the npm publish --dry-run entry point and compare its validation flow with the checks performed during an actual publish. Confirm where the existing package-name similarity conflict is detected, then make dry-run surface that conflict before publishing and verify the behavior with a focused test.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.