I named three developer tools. All three names were taken on npm

说明与用途

在发布 CLI 工具时，作者发现 npm 上已有同名包，导致 npx 运行第三方包而非本地工具。解决方案是在 README 中显式从 GitHub 安装，并在干净环境中验证二进制文件。

问题

Installing a local tool via npx with a bare npm name caused unintended execution of a third‑party package.

结果

The author avoided accidental execution of unrelated packages by explicitly installing from GitHub and verifying the binary, preventing future install‑instruction failures on clean machines.

工作流

• 1. Check npm registry for desired name before publishing.
• 2. Write README install instructions using npm install -g github:org/repo to avoid registry lookup.
• 3. Verify local binary exists by running ./node_modules/.bin/bridle --version in a fresh environment.

证据

All three taken. Not squatted — real packages, by real people:

来源

Six commands in that README would have run a stranger's websocket library on the machine of anyone following my own documentation.

来源

Install explicitly from the repo, then use the short command: npm install -g github:manpreet171/bridle bridle lint

来源