npm package ownership: Need help transfering package ownership from a deactivated user account to new account.

[DevxNetworkServices]

🏷️ Discussion Type

Question

Body

Hi Team,
This is a follow-up regarding our npm ownership recovery request that was previously submitted through the npm Name Disputes submission process earlier this year.

Package
https://www.npmjs.com/package/ibm-networking-services

The npm package ibm-networking-services represents IBM Cloud Network Services SDKs and is actively maintained by the IBM Cloud Network Services DevX team.

Current Owner
Username: ajay-malhotra1

The package ownership is currently tied to the npm account ajay-malhotra1. While we have been able to identify the original owner, the account is no longer accessible for package administration and publishing activities. As a result, we have been unable to recover ownership or perform a transfer through normal means.

Requested New Owner
Username: devxnetworkservices

We are requesting that ownership be transferred to this IBM team-owned npm account, which is used for ongoing maintenance and publishing of IBM-owned packages.

This transfer is required to enable continued maintenance, security updates, and future releases of the SDK.

References
npm package: https://www.npmjs.com/package/ibm-networking-services
IBM-owned repository: https://github.com/IBM/networking-node-sdk
IBM GitHub organization: https://github.com/IBM
Team GitHub account: DevxNetworkServices

Current Status
We initiated the npm/GitHub Trust & Safety ownership transfer process several months ago and have followed up multiple times, but we have not yet received a resolution or timeline.

If anyone has experience with npm ownership recovery or can suggest additional options beyond the Name Dispute process, we would greatly appreciate your guidance.

Thanks in advance.
Sridhar G K (behalf of DevX Network Services)
IBM Cloud Network Services DevX Team

[Ayushgupta2408]

Given that the package is clearly associated with IBM-owned source code and is actively maintained under the IBM GitHub organization, I would recommend continuing to pursue the npm Trust & Safety process and providing additional proof of ownership if requested.

A few things that may help strengthen the case:

Evidence that the npm package corresponds to the official IBM repository.
Confirmation that the current maintainer account is no longer accessible or actively managed.
Documentation showing that the requesting account is controlled by the IBM team responsible for the SDK.
Evidence of ongoing maintenance, releases, and support responsibilities for the package.

Since the package name is tied to an established organization and there appears to be a legitimate business continuity need, this seems like an appropriate case for npm support intervention rather than a standard ownership transfer.

If npm staff are monitoring this thread, could they provide an update on the status of the ownership recovery request or advise whether any additional verification is required from the IBM team?

Hope you're able to get this resolved soon.

[DevxNetworkServices]

Thank you

[maheerCodes]

hey Sridhar 👋.
just to clarify upfront ,, this github community forum cant directly action npm package ownership transfers ,, that lives entirely on npm's side. but a few things that might help move this forward faster ,,,,

the name dispute /trust & safety route u already took is technically the right one ,,but it can stall for months if the ticket doesnt have enough org-level evidence. a few things that tend to unblock these faster :

1. if u havent already ,, try emailing support@npmjs.com directly with the subject line "Ownership Transfer - IBM Org Package - ibm-networking-services" and include ur existing ticket number.direct email sometimes gets picked up faster than the web form queue
2. the strongest evidence u can attach is a side by side showing:

• the npm package homepage(npmjs.com /package / ibm-networking-services) .
• the github repo(github.com/ IBM/ networking-node-sdk),
• and a screenshot of the IBM github org page showing DevxNetworkServices as a member,
  this makes the org ownership connection visually obvious without needing much reading.

3. one thing worth trying on the technical side ,, check if ajay-malhotra1 is still listed as a colllaborator on the IBM github repo,, if they are ,, an org admin can remove them from github which strengthens the "account no longer active/ org controlled" argument in ur npm ticket.
4. if the package has a repository field in its package.json pointing to github.com/IBM/ networking-node-sdk ,, that's actually pretty strong proof that npm can verify programmatically ,,worth mentioning explicitly in ur ticket if u havent .

hope this gets resolved soon ,, IBM maintaining an unmaintainable package is a real security risk for anyone depending on it❤️❤️❤️❤️.

[DevxNetworkServices]

Great idea. will try it out.
for point 3, ajay-malhotra1 is no longer the member/collaborator on the IBM org. I can confirm this.
will construct a mail properly now.
Thank you so much for insights.

[DevxNetworkServices]

Sent a mail explaining and attaching all the evidence. Hoping for the best...

[maheerCodes]

the fact that ajay-malhotra1 is already removed from the IBM org is actually really helpful ,,it removes any ambiguity about whether the original owner still has a valid claim.combined with thepackage.jsonrepo field pointing to IBM's github ,,ur case is aboutt as clean as these get .
npm support response times can vary a lot ,, but if u dont hear back within 7-10 days its worth sending a single folllow-up reply to the same email thread(not a new ticket)just saying "following up on the below,,,,,please advise on timeline"

hope it gets sorted fast ,, keep us posted❤️❤️.

[DevxNetworkServices]

Sure, Will do. Thanks again.

[DevxNetworkServices]

Thank you for the detailed response and suggestions.

Yes, we can demonstrate control of the repository referenced by the package. The repository (IBM/networking-node-sdk) is actively maintained under the IBM GitHub organization, and the requesting account (devxnetworkservices) is an IBM team-owned account with membership in the IBM organization and administrative access to the repository.

We've recently gathered additional evidence, including:

• The npm package metadata linking the package to the IBM-owned repository.
• Active maintenance of the repository by our team.
• IBM organization ownership and access details for the requesting account.

We'll include this information in our follow-up with the npm Trust & Safety team.

Appreciate the guidance.

[DevxNetworkServices]

yes, sure.

[Mohammadshaqboua]

Hi ,
This is a follow-up on our npm ownership transfer request for the package ibm-networking-services, which is an actively maintained IBM Cloud SDK.
The current owner (ajay-malhotra1) is no longer accessible, so we can't publish updates or security fixes. We're requesting a transfer to our team account devxnetworkservices.
We submitted this months ago through the Name Disputes process and have followed up multiple times with no resolution or timeline yet.
Relevant links:

npm: npmjs.com/package/ibm-networking-services
GitHub repo: github.com/IBM/networking-node-sdk

Is there anything we can do to move this forward? Any guidance appreciated.