npm username reservation after GitHub username change

[enmfarooq85]

🏷️ Discussion Type

Question

Body

Hi everyone,

I have a question regarding npm's username reservation policy and its relationship with GitHub usernames.

As I understand it, npm reserves usernames according to GitHub's username policy. My question is about what happens when a GitHub user changes their username.

For example:

A user initially has the GitHub username alice.
They create an npm account associated with that username.
Later, they change their GitHub username from alice to alice-dev.

From what I've observed, the npm username remains alice and does not automatically reflect the new GitHub username.

This raises a few questions:

Is the original npm username permanently reserved by that account?
If GitHub eventually allows the old username (alice) to become available again, can a new GitHub user claim it while the npm username is still owned by the original account?
Is this behavior intentional to prevent package ownership and identity issues, or is there a recommended process for syncing usernames?

I'd appreciate any clarification on how this is designed to work and the reasoning behind the policy.

Thanks!

[Gautam-aman]

npm usernames and GitHub usernames are not continuously synchronized after account creation. While npm may use GitHub usernames during registration or reservation checks, an npm username becomes an independent account identifier once it has been created.

In the example above, if a user creates an npm account with the username alice and later changes their GitHub username to alice-dev, the npm username generally remains alice. The username is still owned by the original npm account and is not automatically updated to reflect GitHub username changes.

In short, GitHub username ownership and npm username ownership are treated as separate concerns after an npm account has been established.

[Hamzaishappy786]

Assalam-u-Alaikum, enmafarooq,

The short answer is: No, npm usernames do not automatically sync with GitHub changes, and this was, I think so to prevent some security risks.

If a user genuinely wants to switch their npm username to match their new GitHub handle, they must manually use npm's username change process (provided the new name is available on npm).

Pliss, mark this as an answer🙏🏻
I really want the galaxy brain achievement🤐

[EnzoSCH1]

Ce comportement est très probablement intentionnel, ou du moins une conséquence acceptée de la conception :

Éviter les conflits d'identité/propriété de packages : si le nom npm suivait automatiquement les changements GitHub, un attaquant pourrait potentiellement changer son nom GitHub vers celui d'un mainteneur connu pour usurper une identité, ou un ancien nom GitHub libéré pourrait être récupéré par quelqu'un d'autre qui « hériterait » ainsi indirectement de la réputation npm associée.
La propriété des packages publiés sur npm reste rattachée au compte npm lui-même (identifiant interne), pas au nom d'utilisateur GitHub courant — le nom d'utilisateur GitHub n'a servi qu'à l'authentification initiale.

Si tu veux vraiment que ton pseudo npm corresponde à ton nouveau pseudo GitHub, il faut changer manuellement le nom d'utilisateur npm via npm profile set username (en supposant que ce nouveau nom est disponible côté npm) — ce n'est pas automatique.

[enmfarooq85]

Please goto this url and see the process of this question.
https://docs.npmjs.com/changing-your-npm-username

[nandagopan006]

Once you create your npm account using your GitHub login, the two accounts essentially decouple when it comes to the username registry. After that initial setup, GitHub and npm treat username ownership as completely separate concerns.

If npm automatically synced your username change from alice to alice-dev, it would open up a massive security hole. For example, if your old alice handle became available on GitHub, a bad actor could claim it and try to hijack your npm identity, or trick developers into downloading malicious packages using your old trusted name.

To answer your specific questions:

Permanence: Yes, your original npm username (alice) remains permanently tied to your npm account until you explicitly change it on npm's side. Package ownership is tied to npm's internal account ID, not your live GitHub handle.

Reclaiming: If a new user claims the now-available alice username on GitHub, they cannot claim the alice username on npm. You still own it on the npm registry.

Syncing: Because of the security risks, there is no automatic sync. If you want your npm handle to match your new GitHub handle, you have to do it manually using npm's official process (usually by running npm profile set username alice-dev in your terminal), assuming the new name is available on the npm registry!