Four npm names without a scope once appeared in published versions of the Palveron
documentation as the target of an npx call. None of them was ever a package. Anyone
who registered one of those names would have received a process start, with
PALVERON_API_KEY in the environment, from every reader who followed the old text.
This repository holds those four names. Each holding package does exactly one thing when run: it prints a message to stderr that names the right way, and it exits with code 1. It never succeeds, so an agent or a shell that ran it by mistake sees a failure, not a success with a note attached.
These names belong to Palveron and are held only so that nobody else can claim them. Nothing in this repository will ever carry functionality.
| Held name | The right way |
|---|---|
agent-shield |
npm install -g @palveron/agent-shield, then palveron shield init |
agent-shield-mcp |
MCP entry with "command": "npx" and "args": ["-y", "-p", "@palveron/agent-shield", "palveron", "shield", "mcp"] |
palveron |
npm install -g @palveron/agent-shield, then palveron shield init; without a global install npx -p @palveron/agent-shield palveron shield init |
palveron-mcp |
@palveron/mcp-server |
Documentation: https://docs.palveron.com
Each package lives in packages/<name>/ with exactly three files: package.json,
bin/lock.mjs, README.md. There are no dependencies, no lockfile, and no shared code.
npm test in the root runs the gate in test/lock-packages.test.mjs, which executes every
holding program and checks its exit code, its stderr, its empty stdout, and its wording.
.github/workflows/publish.yml publishes all four packages once, on a published GitHub
release. The header of that file explains why this repository uses a one-time token instead
of a trusted-publishing relationship.