Post

Fun fact about the NPM replication feed. If you just follow the feed to get updates for ever package, you will miss packages because they retroactively insert changes in the *past* of the feed.

7/10/26, 11:19 pm3 reposts12 likes

Anna | DevMiner

@devminer.xyz

wait, the fuck?

The Projekt

@wearetheprojekt.bsky.social

Retroactive inserts turn a sequence feed into a suggestion. The usual backstop is a nightly full package listing diff, which is the exact job the feed was supposed to retire.

😭

oof. is there any alternative that doesn’t require rescans?

Evert Pot

@evertpot.com

Not that I know of. Maybe we should consider making a downstream replication feed at some point, although we filter out known-malware. cc @darcyclarke.me

Darcy Clarke

@darcyclarke.me

We'll happily provide a better feed for anyone that wants to pay for it 😉

Fabian Iwand

@mootari.social

What's a specific example? I'm only aware of past entries getting dropped for deleted packages. Also, several packuments (don't know yet how many, but will soon) are outdated and require `?write=true` to force revalidation, which may add to the confusion.

naugtur

@naugtur.pl

@socket.dev any known workarounds you found?

Evert Pot

@evertpot.com

I suspect that this happened when NPM transitioned from CouchDB to Postgres. They kept the CouchDB replication feed protocol but it was no longer consistent.

Evert Pot

@evertpot.com

People have been reporting this since 2025 but no official response: github.com/orgs/communi...

github.com`npm replication API` changes and migration guide · community · Discussion #152515Overview As part of our ongoing improvements, we are making changes to our replication API services. This is to ensure availability and performance of our feeds. Moving forward, only a limited set ...

Evert Pot

@evertpot.com

So to accurately replicate NPM, it's not enough to follow the 'sequential' feed, you also have to go back later to see if you missed anything. 🫠

Evangeline Rome 🌵🦎🌱🐢🐍🐸 🥦

@evadeva.bsky.social

yooo This is super, super sad. And a very important thing to note for the designs I considered here

github.comWarn packagers about files with multiple identical paths in their package tarballs · Issue #3223 · npmx-dev/npmx.devDescribe the feature Today I discovered and fixed a bug in Bun's package publishing utilities: oven-sh/bun#41291 We know that neither the TAR standard forbids nor does NPM itself reject such archiv...