{"record":{"id":"bd7472562272a500","repo":"withastro/astro","slug":"invalid-package-name-packagename-package-nam","errorCode":null,"errorMessage":"Invalid package name \"${packageName}\". Package names must follow npm naming rules: lowercase letters, numbers, hyphens, underscores, and dots. Scoped packages like @org/package are also supported.","messagePattern":"Invalid package name \"(.+?)\"\\. Package names must follow npm naming rules: lowercase letters, numbers, hyphens, underscores, and dots\\. Scoped packages like @org/package are also supported\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/internal-helpers/src/cli.ts","lineNumber":43,"sourceCode":"export function validatePackageName(packageName: string): boolean {\n\treturn NPM_PACKAGE_NAME_REGEX.test(packageName);\n}\n\n/**\n * Validates a package name and throws an error if invalid.\n *\n * @param packageName - The package name to validate\n * @throws {Error} If the package name is invalid\n *\n * @example\n * ```ts\n * assertValidPackageName('react'); // OK\n * assertValidPackageName('react; whoami'); // throws Error\n * ```\n */\nexport function assertValidPackageName(packageName: string): asserts packageName is string {\n\tif (!validatePackageName(packageName)) {\n\t\tthrow new Error(\n\t\t\t`Invalid package name \"${packageName}\". Package names must follow npm naming rules: ` +\n\t\t\t\t`lowercase letters, numbers, hyphens, underscores, and dots. ` +\n\t\t\t\t`Scoped packages like @org/package are also supported.`,\n\t\t);\n\t}\n}\n","sourceCodeStart":25,"sourceCodeEnd":50,"githubUrl":"https://github.com/withastro/astro/blob/d081033d5fe8e8a68c4bbbad4af9d2deb9c74bca/packages/internal-helpers/src/cli.ts#L25-L50","documentation":"Thrown by `assertValidPackageName()` in @astrojs/internal-helpers when a string fails the npm naming regex `/^(@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/`. The helper guards CLI commands against shell-metacharacter injection and malformed package references.","triggerScenarios":"Passing user/CLI input containing `;`, `&`, `$`, spaces, uppercase, or other disallowed chars to a command that builds package names (e.g. an `astro add`/create flow). A scoped package with uppercase scope. A name starting with `.` or `_`.","commonSituations":"Accepting a package name from a prompt or env var without sanitizing. A typo like `@Org/Package` (uppercase) or `react; rm -rf /`. Nested scopes (`@a/b/c`) which the regex forbids.","solutions":["Sanitize/normalize the name to lowercase before passing it in.","Validate with `validatePackageName(name)` first and surface a friendly error to end users.","Reject names with shell metacharacters at the input boundary; never interpolate raw CLI args into package names."],"exampleFix":"// before\nassertValidPackageName(inputFromUser); // throws on 'react; whoami'\n// after\nif (!validatePackageName(inputFromUser)) {\n  throw new Error('Please enter a valid npm package name.');\n}\nassertValidPackageName(inputFromUser.toLowerCase());","handlingStrategy":"type-guard","validationCode":"import { validatePackageName } from '@astrojs/internal-helpers';\nif (!validatePackageName(input)) {\n  throw new Error(`'${input}' is not a valid npm package name.`);\n}\nassertValidPackageName(input.toLowerCase());","typeGuard":"function isValidNpmName(name: string): boolean {\n  return /^(@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/.test(name);\n}","tryCatchPattern":"try { assertValidPackageName(name); } catch (e) { if (/Invalid package name/) { /* prompt user again */ } else throw e; }","preventionTips":["Sanitize all external package-name input before passing to CLI helpers.","Reject shell metacharacters at the input boundary.","Lowercase user input before validation."],"tags":["internal-helpers","validation","security","cli","package-name"],"backgroundTag":null,"analyzedSha":"d081033d5fe8e8a68c4bbbad4af9d2deb9c74bca","analyzedAt":"2026-08-12T13:37:29.035Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}