2 days ago
- PEP 752 reserves package name prefixes on PyPI to prevent impersonation, allowing only the grant holder to publish new packages under that prefix, with existing packages grandfathered.
- Common prefixes like django- (17,450 packages), flask- (2,815), and pytest- (2,137) are used by many authors under open conventions, raising questions about the impact of prefix reservation.
- Comparing registries, between 32% and 70% of packages share a first token with others, highlighting the prevalence of prefix patterns across ecosystems.
- Open plugin conventions (e.g., django-, react-, jekyll-) are the largest category among major prefixes, while generated SDK families (e.g., google-cloud-, aws-sdk-) are also significant.
- Bulk publication and tutorial derivatives (e.g., topsis- with 1,999 packages) contribute to many prefixes, and the companion PEP 755 will define who can apply for reserved prefixes, including for popular open-convention ones.