[Bug]: npm namespace confusion — two packages (smithery v1.0.1 and @smithery/cli v4.11.1) point to the same repo

[HaleTom]

What actually happened?

There are currently two npm packages with repository URLs pointing to github.com/smithery-ai/cli, but they have different version numbers and different package names:

Package	Latest Version	Repository
smithery	1.0.1	github.com/smithery-ai/cli
@smithery/cli	4.11.1	github.com/smithery-ai/cli

History: The unscoped smithery package was originally a Software Product Line Engineering tool by tabris87 (versions 0.2.0–0.5.2, repo: github.com/tabris87/smithery). Versions 1.0.0 and 1.0.1 were later published redirecting to github.com/smithery-ai/cli.

This creates several problems:

1. Install confusion: Users running npm install smithery (unscoped) get a different package than npm install @smithery/cli (scoped), but both claim to be the same project.
2. Version discrepancy: smithery is at v1.0.1 while @smithery/cli is at v4.11.1 — a 3+ major version gap.
3. Undocumented takeover: The unscoped smithery package's README/description still references the old SPL project ("The 'house' of SPL blacksmiths..."), not the Smithery MCP CLI. A user who installs smithery will get an unexpected package.
4. Dependents discrepancy: @smithery/cli has 7 dependents and 15.9K weekly downloads; smithery has 0 dependents and 608 weekly downloads — suggesting the older SPL project's users may still be installing the unscoped package.

Terminal output:

$ npm view smithery repository
git+https://github.com/smithery-ai/cli.git

$ npm view @smithery/cli repository
git+https://github.com/smithery-ai/cli.git

What's the expected behavior?

One of:

1. Deprecate the unscoped smithery package on npm with a message directing users to @smithery/cli.
2. Or publish smithery as a thin wrapper/deprecation shim that re-exports @smithery/cli with a clear deprecation notice.
3. Or update the unscoped package's README/description to clearly state it is the Smithery MCP CLI and link to the scoped package.

At minimum, the two packages should not silently co-exist pointing to the same repo with wildly different versions, as this creates a typo-squatting / namespace confusion risk.

Steps to reproduce

1. Run npm view smithery repository — shows github.com/smithery-ai/cli
2. Run npm view @smithery/cli repository — shows github.com/smithery-ai/cli
3. Check npm view smithery versions — shows old SPL versions (0.2.0–0.5.2) redirecting to tabris87/smithery, then v1.0.0–1.0.1 redirecting to smithery-ai/cli

Environment

N/A