An unscoped package is an npm package published in the registry’s global namespace, rather than under an organization or user scope such as @name/package. Because the name is global, any publisher can register a convincing package name if it is still available, and users may install it by mistake.
In cyber security, unscoped packages matter because their names can be used as an attack surface. Threat actors can publish lookalike dependencies, exploit typos, or act on AI-generated package suggestions that sound plausible but are wrong. This supports supply-chain attacks such as slopsquatting, where a trusted-looking name becomes a malicious dependency. Defenses include preferring scoped packages for internal software, verifying the publisher and package provenance, reviewing new dependencies, and using lockfiles or allowlists to block unexpected installs.