fix: scoped names validate blacklist/underscore/core module

Author: owlstronaut

lib/index.js

@@ -80,6 +80,20 @@ function validate (name) {
         errors.push('name cannot start with a period')
       }
 
+      if (pkg.match(/^_/)) {
+        errors.push('name cannot start with an underscore')
+      }
+
+      blacklist.forEach(function (blacklistedName) {
+        if (pkg.toLowerCase() === blacklistedName) {
+          errors.push(blacklistedName + ' is a blacklisted name')
+        }
+      })
+
+      if (builtins.includes(pkg.toLowerCase())) {
+        warnings.push(pkg + ' is a core module name')
+      }
+
       if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
         return done(warnings, errors)
       }

test/index.js

@@ -26,6 +26,26 @@ test('validate-npm-package-name', function (t) {
     warnings: ['name can no longer contain special characters ("~\'!()*")'],
   })
 
+  // Scoped package validation for blacklisted names, underscore starts, and core modules
+
+  t.same(validate('@user/node_modules'), {
+    validForNewPackages: false,
+    validForOldPackages: false,
+    errors: ['node_modules is a blacklisted name'],
+  })
+
+  t.same(validate('@user/_package'), {
+    validForNewPackages: false,
+    validForOldPackages: false,
+    errors: ['name cannot start with an underscore'],
+  })
+
+  t.same(validate('@user/http'), {
+    validForNewPackages: false,
+    validForOldPackages: true,
+    warnings: ['http is a core module name'],
+  })
+
   // Invalid
 
   t.same(validate(null), {