Policies

Every package lives under a scope, like scope/name. A scope is claimed by the first GitHub account that publishes to it and belongs to that account from then on. Publishing requires authenticating with your GitHub account through the Ember CLI.

Scopes are expected to match the identity of whoever publishes under them. Claiming a scope that impersonates another person, project, or company may result in the scope being transferred or released.

Names are first come, first served within a scope. Squatting on names without publishing working code may result in the name being released to someone who will use it.

Names chosen to be confused with an existing popular package (typosquatting) are removed regardless of their contents.

Publish only code you wrote or have the license rights to redistribute, and keep the package's license file accurate. Tarballs are capped at 10 MB (subject to increase).

Published versions are immutable: a version number can never be overwritten or edited, only superseded by a newer version. Ship a new version to fix a mistake.

Check what you publish. If you accidentally include a secret such as an API token, rotate it immediately and contact admin@emberpm.dev to get the version removed; assume anything published has already been seen.

Because other projects may depend on your package, removal is the exception, not a routine operation. Packages are removed for malware, legal requirements, leaked secrets, or at the publisher's request when the package is clearly not yet depended on.

To request a removal, contact admin@emberpm.dev.

Packages that contain malware, obfuscated payloads, code that exfiltrates user data, hidden miners, or anything else designed to harm the people installing them are removed and their publishers banned.

Spam also qualifies: mass-published placeholder packages, content farms, and packages whose only purpose is advertising are removed.

If you find a vulnerability in a published package, in the Ember CLI, or in the registry itself, report it privately to admin@emberpm.dev rather than opening a public issue, so it can be fixed before it is advertised.

Ember is a name, not an acronym. It does not stand for Luau Package Manager, and it never did. If you want an expansion, the only one on offer is recursive: EMBER Makes Building Easy, Really. The first letter expands to the whole name again, so the definition never bottoms out. Any other reading of the letters is a backronym someone made up afterwards.

The command is spelled embr, and the tool runner beside it is embx. Both are the same name with the vowels burned out of it.

Ember is an independent project. It has no affiliation with the Luau team, with Roblox Corporation, or with any of its subsidiaries, and none of them endorses or sponsors this registry. Luau and Roblox are the trademarks of their owners. This site names them only to say what language the packages are written for.

To report a package that violates these policies, infringes your copyright or trademark, or uses a name you believe you have a better claim to, open an issue on GitHub or write to admin@emberpm.dev. Include the package name, the versions affected, and what you are asking for.

Everything about a published package is public: its full contents, metadata, version history, your GitHub username, and download counts. Download statistics are aggregated from CDN request logs and updated on an hourly basis, so counts are slightly delayed rather than live, and a freshly published package shows no count until the first nightly update after its first hour. The registry does not build profiles of who installs what.

Public also means cached. Mirrors, proxies, and installs keep copies, so treat publishing as permanent even where removal is possible.

Package downloads and the search index are served from a CDN and are free to use at any scale, including in CI. The metered API exists for the CLI and the website; bulk scraping it instead of using the CDN files may be rate limited or blocked.

Depending on severity, enforcement ranges from a warning to package removal to banning the account and releasing its scope. Decisions are made by the registry maintainers; write to admin@emberpm.dev if you believe one was wrong.