Why rgstr

A naming layer over npm and PyPI. Every name has a page here that says who claims it (or that nobody does), how far that was checked, and where installs of it are served from.

Not a mirror. rgstr stores no package files. When your client asks rgstr for a package, rgstr fetches the listing from the index that publishes it, passes it through with the download links pointed at rgstr, and answers each download with a redirect to the real file on the index. The bytes you install are the index's bytes.

Not a scanner. rgstr does not read code for malware or judge a package's quality. It answers one question: is this name claimed, by whom, and how was that proved.

npm and PyPI give any free name to whoever asks first, and their search ranks by popularity and text. rgstr adds three things on top.

Claims are applications. A name is claimed only after a person at rgstr approves the claim. The one proof is the rgstr badge in the package's README: the README of the GitHub repository the package declares on npm or PyPI (read from GitHub, no release), or the README that ships with the package (read from the index on the next publish). Nothing is granted on say-so.

Copies are fingerprinted. When someone claims a name, the package behind it is compared with every package rgstr already claims: tarball checksum, per-file hashes, README, version history, repository. A likely copy is never approved automatically, its page says what it is a copy of, and search folds copies under their original.

The claimant is public. Every claimed name shows who claims it and where the badge was found. A second claim on a claimed name is reviewed by a person with the claimant told, never a quiet transfer.

unclaimed

Nobody has claimed this name on rgstr yet. Installs come straight from npm or PyPI, unchanged.

claimed

A maintainer's claim to this name was reviewed and approved; the organization that claims it decides where installs are served from.

verified

Claimed, and the claimant's identity was verified — a person's government ID, or a registered company and its representative.

unclaimed is a fact about the name, not a warning about the package. Most of npm and PyPI is unclaimed on rgstr today.

On rgstr: the name's page shows who claims it and the trust level, and installs that go through rgstr follow the claimant's routes: which registry, which package name there, for which version range. Until the claimant sets a route, installs pass through to the default index unchanged. Teams that install with an rgstr organization token can set a policy that only allows claimed or verified names.

Not on npm or PyPI: nothing. A claim gives the claimant no rights on the index: not the listing, not publish access, not the files. Installs that do not go through rgstr do not see the claim at all.

Installs that go through rgstr fail until it is back. rgstr setuppoints your project's .npmrc or pip index at rgstr.org, so every listing request and every download goes through us; when we do not answer, your client errors the way it does for any unreachable registry. Whatever is already in your local package cache still installs. There is no automatic fallback to npm or PyPI built in today.

To point installs back at npm or PyPI immediately: rgstr setup --off, or delete the block rgstr wrote in your .npmrc or pip config.

If npm or PyPI is down, installs through rgstr fail too: the proxy fetches every listing fresh and never caches files, so it cannot serve what the index will not.

Each request to the install proxy writes one row: the package name; what was asked for (a version, the package listing, or a file); where it was routed; whether it passed or was blocked; a short note (why a policy blocked it, or the upstream error); the time; and, only when the request carried an organization token, that organization's id.

That row does not contain your IP address, user agent, or account. There is no retention schedule for these rows yet: they are kept until we delete them.

Beyond that: the hosting platform keeps its own standard request logs, as any host does, and the web pages on rgstr.org load product analytics (PostHog). The install proxy does not.

Any claimed name can be contested from its page or the claim page. A second application on a claimed name is the dispute: the current claimant keeps the name and its routes, is told, and a person at rgstrreviews both sides. The name's public page does not change — anyone can file an application, so one says nothing about the name. Evidence that counts: the rgstr badge in the package's README, identity verification, and a written statement.

Claiming an unclaimed name is free. Contesting a claimed name is free today; it may carry a fee later to keep the queue honest.

There is no status page yet. rgstr is run by ComputeSDK; write to support@computesdk.com for anything on this page, including a claim you think was decided wrongly.