Post

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵

The npm registry has no proper issue tracker. Feedback gets dumped into a GitHub Discussions space, mixed with everything else, rarely getting an official reply. npm is critical infra for millions of developers. It deserves its own dedicated, staffed, public tracker. This isn't optional.

Then there are the recent security incidents. Supply chain attacks keep landing on npm, and the responses tend to be slow and opaque. When you operate the registry the world depends on, "we're looking into it" days later isn't accountability. It's risk externalized onto the ecosystem.

So here's the ask: **open source the npm registry** Microsoft acquired npm in 2020. The bar isn't even "make it better." It's "stop making it worse." A closed registry controlled by one company is a structural risk the JS ecosystem shouldn't have to carry.