identity-namespace-binding

transform

PackageNamespace, PublisherIdentity -> IsAuthorized

Validate that a hierarchical namespace prefix matches the verified identity (e.g., GitHub username or OIDC repo scope) of the publisher.

Problem it solves

Preventing namespace squatting and unauthorized publication under names associated with established GitHub accounts/organizations.

Consumes

PackageNamespacePublisherIdentity

Emits

IsAuthorized

Distilled from 1 source

The real projects this mechanism was found in. Attribution is the point — this is how the best teams actually do it.