[dickeytk]

In the example, I'm not sure npm can really do much to fix this. package.json entries can have any arbitrary content. "dependncies" might be valid as far as npm knows, and the dependencies section is optional.

[skybrian]

Maybe that's the problem? The file format is too loose and it shouldn't allow arbitrary content anywhere.

[__derek__]

This seems like a situation where npm can't win. If it only allows npm-specific information in the package.json, then people will complain about how they have to have 10 different configuration files in the root of a JavaScript project. If they allow arbitrary configuration, it's blamed for being too permissive.

[skybrian]

There are other possibilities. They could have a registry for allowed keys, or allow them but only under "extensions".

[lsiebert]

Even so, your error parser could examine common layouts, and figure out that while depndencies could be correct, it probably was meant to be dependencies.

[__derek__]

While true, it would seem appropriate to inform a user that they tried to run `npm install` with no arguments and with no dependencies in their package.json.