The regex now uses "Atomic Groups" to make sure there is no backtracking
and no performance issues on malicious package names