They did so because Andrew, CEO, and co-founder of streaming app Rainway, pointed that npm’s process was none of those things.
Sampson emailed the listed address, got no reply, and four weeks later was rewarded with a note from npm giving him control of the Bebop name.
Github’s npm team shouldn’t have done so because the registry had the incorrect email address for the person who had registered Bebop and had been using it for more than eight years.
According to Sampson, none of the emails linked with Kelling’s account got the name inquiry and the email address generated by the command npm owner ls bebop wasn’t linked with the package.
“Zach only noticed the ownership had been taken away from his account because an update failed to publish,” Sampson said on twitter.
Earlier this year, npm indefinitely suspended their process for “adopting an abandoned package” (wiping all references to it from their documentation.)
That was because of me. A thread 🧵 1/?
Sampson said Kelling initiated a ticket with npm support and was told he would not get the name back, but was granted a GitHub Pro subscription and a $100 credit for GitHub merch “for the inconvenience.”
Kelling did not quickly react to a request for comment.
Sampson said he settled up compensating Kelling for the name after he reached out directly. And Kelling subsequently renamed his original Bebop package “bebop-cli.”
“Package adoption creates new avenues for compromising supply chains – registries should not be facilitating it,” he wrote. “If a package transfer does need to occur, then the only method to do so should be the owner doing it. The registry itself shouldn’t have the ability.”
In an email to The Register, Sampson expressed sympathy for GitHub and npm, accepting package management and registry operation are both difficult.
“I think mistakes are inevitable at the scale of something like npm,” he said. “That being said, their response to the developer that was impacted by their mistake was pretty awful. That is why we ended up paying him $5,000 because I understand that for a developer time is their most valuable commodity, and the undue stress and disruption caused by their mistake likely hampered them for a few days.”
He said he was happy npm suspended its transfer process as a consequence of the incident and noted that the support rep he dealt with suggested that past incidents of this sort had already indicated changes in npm’s processes.
Transfers of authority over package names at npm have proven problematic in the past, as the 2019 PureScript incident demonstrates. Other package registries have faced similar problems.
The Java ecosystem, like some others, has dealt with possible name conflicts through hierarchical namespaces. For example, a Java program will reference com.example.library_name.package_name, as opposed to just package_name. This suggests a simple way to avoid identical package names.
“I think it is a hard problem to solve,” said Sampson. “Should a package name be lost forever simply because someone registered it over a decade ago and never actually used it? What happens if the owner of a popular package dies and they never assigned other primary contributors, is a fork now forced by the community? There is a lot of nuances involved here. People much smarter than me will figure out a system that works – that is the beauty of open source.”