npm false positive: "graph8" blocked as too similar to "graphql"

[thomascorneliusg8]

🏷️ Discussion Type

Question

Body

Hi npm / GitHub team,

I’m requesting a manual review of an automated name-similarity block preventing us from publishing the package name graph8.

Summary

• Attempted package name: graph8
• Blocked with: “Package name too similar to existing package graphql”
• Current workaround: @graph8/sdk
• Desired outcome: approval to publish unscoped package graph8

Why this appears to be a false positive

• graph8 is not a lexical or visual variant of graphql
• Different suffix (8 vs ql)
• Different pronunciation and meaning
• No intent to mimic or intercept traffic
• No overlap in branding or positioning

Ownership & legitimacy

• graph8 is our company and product name
• Domain: https://graph8.com/
• We already publish under the npm org @graph8

Impact

• Forces use of a scoped package instead of canonical name
• Adds friction for developer adoption
• Creates inconsistency between product name and install name

Request

• Please review and override the similarity block for graph8, or
• Clarify what criteria would allow approval

Happy to verify ownership via domain, GitHub org, or other signals.

Thanks,
Thomas

[AviJxn]

Hi Thomas,

This does look like an automated similarity check being triggered rather than a manual decision the npm has protections in place to prevent typosquatting and brand confusion, and sometimes they can be overly strict.

A few important points:

1. You can’t bypass this from the publish command
   When a name is blocked for similarity, it typically requires a manual review by npm support there isn’t a flag or config that overrides it locally.

2. Use the official npm support channel (important)
   You’ll need to open a request here:
   https://www.npmjs.com/support

Include exactly what you’ve already written:

• Package name (graph8)
• Error message
• Justification (different meaning, branding, pronunciation)
• Proof of ownership (domain, GitHub org, existing @Graph8 scope)

3. Your argument is reasonable
   “graph8” vs “graphql”:

• Different suffix and semantics
• Not a common typo pattern
• Clear branding separation

So this is a good candidate for a manual override.

4. What usually helps approval

• Matching domain (graph8.com -->good signal)
• Active GitHub org (@Graph8)
• Consistent branding across platforms

5. While waiting
   Continuing with @graph8/sdk is the correct workaround many projects stay scoped even after approval requests.

In short this isn’t something you did wrong it just needs manual review from npm, and your case looks valid for reconsideration.

Hope that helps, and good luck with the approval

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬