# Scoped packages to triage package squatting **URL:** \ **Category:** cargo\ **Created:** [September 26, 2024, 2:43am UTC](https://internals.rust-lang.org/t/scoped-packages-to-triage-package-squatting/21597 "2024-09-26T02:43:54Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![mcandre](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/mcandre/32/2243_2.png) [@mcandre](https://internals.rust-lang.org/u/mcandre)\ **Post date:** [September 26, 2024, 2:43am UTC](https://internals.rust-lang.org/t/scoped-packages-to-triage-package-squatting/21597/1 "2024-09-26T02:43:54Z")
Last I checked, [crates.io](http://crates.io) was littered with hundreds of useless parking packages, similar to how domain names encourage squatters. As a developer, it's often difficult to come up with a meaningful, unique name, which hasn't been used before in Cargo, hasn't been used in common ([linux.die.net](http://linux.die.net)) utilities, hasn't appeared in other git repository names, hasn't been bought by a domain registrar... The Venn diagram of available names there is a tiny sliver. We can help developers publish packages more easily, by phasing out the existing package names in favor of scoped names, similar to what NPM offers. As a bonus, scoped names help to protect against fraudulent packages. Attacking a system shouldn't be as easy as slapping a "-v2" prefix on top of an existing package name. ---
**Author:** ![kpreid](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/kpreid/32/8484_2.png) [@kpreid](https://internals.rust-lang.org/u/kpreid)\ **Post date:** [September 26, 2024, 3:49am UTC](https://internals.rust-lang.org/t/scoped-packages-to-triage-package-squatting/21597/2 "2024-09-26T03:49:04Z")
> [@mcandre](#): > > Last I checked, [crates.io](http://crates.io) was littered with hundreds of useless parking packages, similar to how domain names encourage squatters. The crates.io team is currently deleting such packages as they are discovered. If you find some not yet deleted, you can report them to [help@crates.io](mailto:help@crates.io), as mentioned in the [policy](https://crates.io/policies). > [@mcandre](#): > > We can help developers publish packages more easily, by phasing out the existing package names in favor of scoped names, similar to what NPM offers. As a bonus, scoped names help to protect against fraudulent packages. Attacking a system shouldn't be as easy as slapping a "-v2" prefix on top of an existing package name. This has been proposed many times. Please review the prior discussions to understand why it hasn’t already been done, and what a new argument for it would need to address. - [https://github.com/rust-lang/rfcs/pull/2978](https://github.com/rust-lang/rfcs/pull/2978) - [Pre-RFC: User namespaces on crates.io](https://internals.rust-lang.org/t/pre-rfc-user-namespaces-on-crates-io/12851) - [Pre-RFC: (hyper)minimalist namespaces on crates.io](https://internals.rust-lang.org/t/pre-rfc-hyper-minimalist-namespaces-on-crates-io/13041) - [Namespacing on Crates.io](https://internals.rust-lang.org/t/namespacing-on-crates-io/8571) - [Scoped packages (like in npm)?](https://internals.rust-lang.org/t/scoped-packages-like-in-npm/10223) There is, however, an _accepted RFC_ (which could use some help with implementation work) that will improve the situation in this space: [RFC 3243, Packages as namespaces](https://rust-lang.github.io/rfcs/3243-packages-as-optional-namespaces.html). This will take the pressure off of `projectname-packagename` pseudo-namespacing by allowing the owners of a particular package to publish further packages which are in the namespace of _that package_, and thus unambiguously approved by that same owner. ---
**Author:** ![steffahn](https://sea2.discourse-cdn.com/flex002/user_avatar/internals.rust-lang.org/steffahn/32/13288_2.png) [@steffahn](https://internals.rust-lang.org/u/steffahn)\ **Post date:** [March 20, 2026, 3:49am UTC](https://internals.rust-lang.org/t/scoped-packages-to-triage-package-squatting/21597/3 "2026-03-20T03:49:04Z")
This topic was automatically closed 540 days after the last reply. New replies are no longer allowed.