Skip to content

Docs: clarify there is no official npm package (impersonation/typosquat awareness)#5299

Merged
nlohmann merged 2 commits into
nlohmann:developfrom
banaboi:docs/no-official-npm-package
Jul 23, 2026
Merged

Docs: clarify there is no official npm package (impersonation/typosquat awareness)#5299
nlohmann merged 2 commits into
nlohmann:developfrom
banaboi:docs/no-official-npm-package

Conversation

@banaboi

@banaboi banaboi commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Clarify that this project does not publish an official npm package, so users who find nlohmann-json (or similar) on npm know it is not maintained or endorsed here.
  • Add short pointers in the FAQ and security policy so the same statement is easy to find after a scanner or search flags the npm name.

This is documentation-only, addressing #5292 after a malicious npm typosquat

  • The changes are described in detail, both the what and why.
  • If applicable, an existing issue is referenced.
  • The Code coverage remained at 100%. A test case for every new line of code.
  • If applicable, the documentation is updated.
  • The source code is amalgamated by running make amalgamate.

Read the Contribution Guidelines for detailed information.

@banaboi
banaboi requested a review from nlohmann as a code owner July 23, 2026 05:51
@banaboi
banaboi force-pushed the docs/no-official-npm-package branch from 6ac762c to ac30cb2 Compare July 23, 2026 05:54
nlohmann
nlohmann requested changes Jul 23, 2026
View reviewed changes
Comment thread docs/mkdocs/docs/home/faq.md Outdated

## Usage

### Official npm package

@nlohmann nlohmann Jul 23, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though the issue mentioned the FAQ, I'd remove it here - nobody ever asked it.

@banaboi banaboi Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

removed

Comment thread docs/mkdocs/docs/integration/package_managers.md
Comment thread .github/SECURITY.md Outdated

## Unofficial packages

This project does not publish an official npm package. Any npm package named `nlohmann-json` (or similar) is not

@nlohmann nlohmann Jul 23, 2026

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe mention/link the fake package here.

@banaboi banaboi Jul 23, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

done

banaboi added 2 commits July 23, 2026 21:51
@banaboi
updating docs to clarify absence of npm package
b7035b9 
Signed-off-by: banaboi <lukebanicevic@gmail.com>
@banaboi
addressing review comments
7534450 
Signed-off-by: banaboi <lukebanicevic@gmail.com>
@banaboi
banaboi force-pushed the docs/no-official-npm-package branch from a240754 to 7534450 Compare July 23, 2026 11:51
@banaboi
banaboi requested a review from nlohmann July 23, 2026 11:51
nlohmann
nlohmann approved these changes Jul 23, 2026
View reviewed changes

@nlohmann nlohmann left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

@nlohmann nlohmann linked an issue Jul 23, 2026 that may be closed by this pull request
Docs: clarify there is no official npm package (impersonation/typosquat awareness) #5292
Closed
@nlohmann nlohmann added this to the Release 3.13.0 milestone Jul 23, 2026
@nlohmann

nlohmann commented Jul 23, 2026

Copy link
Copy Markdown
Owner

Thanks!

@nlohmann
nlohmann merged commit 3296a3a into nlohmann:develop Jul 23, 2026
155 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nlohmann nlohmann nlohmann approved these changes

Assignees

No one assigned

Labels

documentation M

Projects

None yet

Milestone

Release 3.13.0

Development

Successfully merging this pull request may close these issues.

Docs: clarify there is no official npm package (impersonation/typosquat awareness)

2 participants

@banaboi @nlohmann