Do we want to enforce something as strict as the CJS spec?  It's a little harsh that it can't include uppercase letters -- camelcase repo names aren't that unusual in GH... right now we flat-out _refuse_ to install from all such repos, right?