apache/superset · error · ExtensionNameError

'{name}' is a reserved npm package name

Error message

'{name}' is a reserved npm package name

What it means

validate_npm_package_name in the extensions CLI rejects names whose lowercase form is in the npm reserved list (e.g. node_modules, npm, core, http). The generated frontend package would collide with reserved npm namespaces, so scaffolding stops before writing files.

Source

Thrown at superset-extensions-cli/src/superset_extensions_cli/utils.py:216

    if (first_part := name.split("_")[0]) in PYTHON_KEYWORDS:
        raise ExtensionNameError(
            f"Package name cannot start with Python keyword '{first_part}'"
        )

    # Check if it's a valid Python identifier
    if not name.replace("_", "a").isalnum():
        raise ExtensionNameError(f"'{name}' is not a valid Python package name")


def validate_npm_package_name(name: str) -> None:
    """
    Validate npm package name (kebab-case format).

    Raises:
        ExtensionNameError: If name is invalid
    """
    if name.lower() in NPM_RESERVED:
        raise ExtensionNameError(f"'{name}' is a reserved npm package name")


def validate_publisher(publisher: str) -> None:
    """
    Validate publisher namespace format.

    Args:
        publisher: Publisher namespace (e.g., 'my-org')

    Raises:
        ExtensionNameError: If publisher is invalid
    """
    if not publisher:
        raise ExtensionNameError("Publisher cannot be empty")

    if not PUBLISHER_REGEX.match(publisher):
        raise ExtensionNameError(
            "Publisher must start with a letter and contain only lowercase letters, numbers, and hyphens (e.g., 'my-org')"

View on GitHub (pinned to f4587218dd)

Solutions

1. Pick a non-reserved name, e.g. 'superset-core-ext' instead of 'core'.
2. Namespace the name under an org prefix so it no longer exactly matches a reserved word.
3. Check NPM_RESERVED in the CLI source for the current list when automation must pre-filter.

Example fix

# before
$ superset-extension new npm-tools
# after
$ superset-extension new tools-npm

from superset_extensions_cli.utils import NPM_RESERVED

def npm_name_is_safe(name: str) -> bool:
    return name.lower() not in NPM_RESERVED

try:
    validate_npm_package_name(name)
except ExtensionNameError as e:
    print(f'Reserve-word collision: {e}')
    sys.exit(2)

When it happens

Trigger: Scaffolding an extension named 'node_modules', 'npm', 'http-handler' whose normalized npm name equals a reserved word (exact, case-insensitive match).

Common situations: Names like 'core', 'http', 'https', 'node_modules' chosen for infrastructure-ish extensions; case variants ('NPM') hitting the case-insensitive check.

Related errors

• Package name '{name}' cannot start with a number
• Package name cannot start with Python keyword '{first_part}'
• '{name}' is not a valid Python package name
• Publisher cannot be empty
• Publisher must start with a letter and contain only lowercas

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/d71b9cd33d5b9cea. Report an issue: GitHub.