Scoped packages to triage package squatting

Last I checked, crates.io was littered with hundreds of useless parking packages, similar to how domain names encourage squatters.

As a developer, it's often difficult to come up with a meaningful, unique name, which hasn't been used before in Cargo, hasn't been used in common (linux.die.net) utilities, hasn't appeared in other git repository names, hasn't been bought by a domain registrar... The Venn diagram of available names there is a tiny sliver.

We can help developers publish packages more easily, by phasing out the existing package names in favor of scoped names, similar to what NPM offers. As a bonus, scoped names help to protect against fraudulent packages. Attacking a system shouldn't be as easy as slapping a "-v2" prefix on top of an existing package name.

1 Like

The crates.io team is currently deleting such packages as they are discovered. If you find some not yet deleted, you can report them to help@crates.io, as mentioned in the policy.

This has been proposed many times. Please review the prior discussions to understand why it hasn’t already been done, and what a new argument for it would need to address.

There is, however, an accepted RFC (which could use some help with implementation work) that will improve the situation in this space: RFC 3243, Packages as namespaces. This will take the pressure off of projectname-packagename pseudo-namespacing by allowing the owners of a particular package to publish further packages which are in the namespace of that package, and thus unambiguously approved by that same owner.

8 Likes