vendor and package name in lowercase