Namespace squatting is registering a package name, scope or prefix that clearly belongs to someone else, or to nobody yet, to block them or to catch installs. Registries limit it with scopes, reserved prefixes and ownership checks. None is complete, so teams should also claim their own names.
Definitions
- Name squatting: registering a name only to hold it. npm's policy treats a package name as squatted if the package has no genuine function.
- Typosquatting: registering a name that is a near miss of a popular one. See our typosquatting anatomy post.
- Namespace squatting: claiming a scope, prefix or group name that implies a trusted owner.
How three registries approach it
| Registry | Mechanism | What it gives you |
|---|---|---|
| npm | Scopes like @org/package tied to a user or organization | You can reuse a short name without conflict, and the scope belongs to one account |
| NuGet (nuget.org) | ID prefix reservation | Packages with a reserved prefix are rejected unless they come from the owner, and show an indicator |
| Maven Central | groupId verification | You prove control of a domain or a code hosting account before publishing under it |
The NuGet documentation adds a limit: packages that existed before a reservation stay as they were. They are not unlisted, they just do not get the indicator.
For Maven Central, the page we read describes proving ownership with a DNS record for a domain, or with a temporary repository for io.github style names. The process may have changed since that page was written, so check the current Central documentation before relying on the details.
Where scopes stop helping
A scope protects the names inside it. It does not stop someone registering a similar scope, and it does not help if your own tooling is configured to look for the scope on the public registry. That second gap is the dependency confusion problem. See dependency confusion explained.
npm's dispute policy is also blunt. It says it does not resolve squatting claims on demand, and it points trademark issues to GitHub's trademark process.
What you can do
- Make a list of the names your organization owns, internal and public.
- Claim the scope or prefix on every public registry you use.
- Configure clients so internal names resolve only to your own registry.
- Watch for new packages that resemble your names.
Quick check
Does an npm scope prevent typosquatting?
No. It protects the exact scope you own. Someone can still publish a package with a similar scope or a lookalike name.
Can I get a squatted package name transferred to me?
Do not count on it. npm says it does not resolve squatting claims on demand. Trademark claims follow a separate process.
Safeguard does SBOM and dependency scanning, and you can run a free scan to see which names in your tree come from which sources.
Sources
Last reviewed: 19 October 2026.
