# Popular npm package names, used ONLY as the reference set for the
# edit-distance typosquat check (feature D).
#
# This is public, well-known ecosystem data, not scan output and not target
# data. It is deliberately a hand-maintained shortlist rather than a scraped
# top-N: the check reports a name that is 1-2 edits from an entry here, so every
# addition widens what can be flagged. A short, high-confidence list produces
# far fewer false positives than a long tail of rarely-typed names.
#
# Rules for editing:
#   - one lowercase name per line, '#' comments and blank lines ignored
#   - names shorter than 4 characters are ignored by the checker regardless
#     (too many legitimate packages sit 1 edit from "ms" or "qs")
#   - do NOT add a name that is itself a common English word fragment
abbrev
accepts
acorn
ajv
ansi-colors
ansi-regex
ansi-styles
anymatch
argparse
array-flatten
async
asynckit
axios
babel-loader
balanced-match
base64-js
binary-extensions
bluebird
body-parser
brace-expansion
braces
browserslist
buffer
bytes
call-bind
camelcase
caniuse-lite
chalk
chokidar
chownr
classnames
clean-css
cliui
color-convert
color-name
colorette
combined-stream
commander
concat-map
content-disposition
content-type
convert-source-map
cookie
cookie-parser
cookie-signature
core-js
core-util-is
cors
cross-spawn
crypto-js
css-loader
d3
dayjs
debug
decamelize
decompress-response
deep-equal
deep-extend
define-property
delayed-stream
depd
destroy
detect-indent
dotenv
duplexer
eastasianwidth
ee-first
electron
emoji-regex
encodeurl
end-of-stream
enhanced-resolve
error-ex
es-abstract
escalade
escape-html
escape-string-regexp
eslint
eslint-config-prettier
eslint-plugin-import
eslint-plugin-react
esprima
esrecurse
estraverse
esutils
etag
event-target-shim
eventemitter3
events
execa
express
extend
fast-deep-equal
fast-glob
fast-json-stable-stringify
fast-levenshtein
fastq
figures
file-entry-cache
fill-range
finalhandler
find-up
follow-redirects
foreground-child
form-data
forwarded
fresh
fs-extra
fs-minipass
fsevents
function-bind
get-caller-file
get-intrinsic
get-stream
glob
glob-parent
globals
globby
graceful-fs
handlebars
has-flag
has-property-descriptors
has-symbols
hasown
he
http-errors
http-proxy-agent
https-proxy-agent
human-signals
iconv-lite
ieee754
ignore
immer
import-fresh
imurmurhash
inflight
inherits
ini
inquirer
internal-slot
ipaddr.js
is-arrayish
is-binary-path
is-core-module
is-extglob
is-fullwidth-code-point
is-glob
is-number
is-plain-obj
is-stream
isarray
isexe
jackspeak
jest
jest-cli
jose
js-tokens
js-yaml
jsesc
json-schema-traverse
json-stable-stringify
json5
jsonfile
jsonwebtoken
jsx-ast-utils
kind-of
kleur
levn
lilconfig
lines-and-columns
locate-path
lodash
lodash.merge
log-symbols
loose-envify
lru-cache
make-dir
media-typer
merge-descriptors
merge-stream
merge2
methods
micromatch
mime
mime-db
mime-types
mimic-fn
minimatch
minimist
minipass
minizlib
mkdirp
moment
mongoose
mustache
mute-stream
nanoid
negotiator
next
node-fetch
node-forge
node-gyp
nodemon
normalize-path
npm-run-path
nth-check
object-assign
object-inspect
on-finished
once
onetime
optionator
ora
os-tmpdir
p-limit
p-locate
p-map
package-json
parent-module
parse-json
parseurl
path-exists
path-is-absolute
path-key
path-parse
path-scurry
path-to-regexp
path-type
picocolors
picomatch
pify
pino
pkg-dir
postcss
postcss-loader
prelude-ls
prettier
process-nextick-args
progress
prompts
prop-types
proxy-addr
pump
punycode
qrcode
querystringify
queue-microtask
randombytes
range-parser
raw-body
react
react-dom
react-is
react-redux
react-router
react-router-dom
readable-stream
readdirp
redux
regenerator-runtime
regexpp
request
require-directory
requires-port
resolve
resolve-from
restore-cursor
reusify
rimraf
run-parallel
safe-buffer
safer-buffer
sass
sax
semver
send
serve-static
set-blocking
setprototypeof
shebang-command
shebang-regex
side-channel
signal-exit
slash
slice-ansi
socket.io
socket.io-client
source-map
source-map-js
source-map-support
sprintf-js
statuses
string-width
string_decoder
strip-ansi
strip-bom
strip-final-newline
strip-json-comments
supports-color
supports-preserve-symlinks-flag
svelte
tailwindcss
tapable
tar
terser
terser-webpack-plugin
text-table
through
tmp
to-regex-range
toidentifier
tough-cookie
tslib
type-check
type-fest
type-is
typescript
uglify-js
undici
undici-types
universalify
unpipe
uri-js
url-parse
util-deprecate
utils-merge
uuid
validate-npm-package-license
vary
vite
vue
watchpack
wcwidth
webidl-conversions
webpack
webpack-cli
whatwg-url
which
which-boxed-primitive
wide-align
word-wrap
wrap-ansi
wrappy
write-file-atomic
ws
xtend
y18n
yallist
yaml
yargs
yargs-parser
yocto-queue
zod