npm Blocked the Name 'estee' as Too Similar to 'testem', and Support Says It Cannot Override the Typosquat Check

npm's registry rejected a publish of a package named estee with the message "Package name too similar to existing packages espree,testem", and npm support told the developer "We are unable to get around the automated typosquat block." The account comes from smoores, who maintains a forced-alignment command-line tool for the Storyteller project and describes it in a post on smoores.dev. The name was meant for v0.0.1, published only to set up Trusted Publishing from GitLab.

The control is a defensive one. Typosquatting packages depend on names that a hurried developer mistypes. The related impersonation story this site covered, a fake Claude Code 2.1.313 that planted SSH keys, ran through an editor marketplace rather than npm, and the Binance breach shows where stolen developer access ends up. The question smoores raises is how many legitimate names the check also stops.

What the post claims

Smoores believes npm applies a Levenshtein distance check, which counts single-character edits, with a threshold of 2 or less against popular package names. That is an inference from the error text, not something npm documents. "estee" is two edits from "testem", a test runner, which smoores finds implausible as a typo.

A backup name, hoid, was flagged as similar to hono, uuid, zod and gopd. Smoores argues the rule would also block preact against react and estree against espree. An earlier package, @storyteller-platform/audiobook, returned "That name is not allowed", and npm support lifted that block quickly after an email. A second request for estee was declined, and smoores plans to use estie instead.

The post's arithmetic on short names changed after publication. A Lobsters commenter said smoores had originally given 1.2% as the share of four-character names a distance-2 rule could cover, when the correct figure is about 0.12%, or 841 names out of 707,281.

Other developers, same error

Date	Name blocked	Error text	Staff reply on thread
May 5, 2026	redisvl (Redis Inc.)	similar to existing package redis	None
Sept. 19, 2026	jpcl	similar to jscs,sjcl,psl	None
Oct. 30, 2026 (post date)	estee	similar to espree,testem	Support email, per the author

In GitHub Community discussion 194929, a poster writing for Redis Inc., which maintains the redis package, asked for a manual review so the Redis Vector Library could publish as redisvl. The discussion closed unanswered. In discussion 208302, a developer was refused jpcl and told by other users to use a scope. Replies in both came from community members, not npm staff.

The workaround repeated in all three is a scoped name such as @redis/redisvl, optionally with a bin entry so users still type the short command.

What is not known

Npm has not published the distance threshold or the list of names the check compares against, so the Levenshtein reading is unverified. The three cases above are what turned up in public threads. They do not show how often the check fires, how many blocks support lifts, or whether any real typosquat has been stopped by this rule. Smoores says the npm blog post support cited describes a rule about names differing only by punctuation, not the rule that blocked estee.

The practical constraint for publishers today is that an unscoped name within roughly two edits of a popular package may return E403, and the only confirmed route round it in these cases is a scope or a different name. Smoores's next publish will be under estie.