Post

Kevin Deng
@sxzz.dev

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵

Kevin Deng
@sxzz.dev

One concrete example. This issue on npm/cli: github.com/npm/cli/issues/8768 Open for six months. Zero official replies. It's not an outlier, it's the pattern. Real users posting real bug reports, just sitting there with no response from anyone at npm.

github.com[BUG] `publishConfig.tag` Not Respected · Issue #8768 · npm/cliIs there an existing issue for this? I have searched the existing issues This issue exists in the latest npm version I am using the latest npm Current Behavior npm publish doesn't respect publishCo...
Kevin Deng
@sxzz.dev

The npm registry has no proper issue tracker. Feedback gets dumped into a GitHub Discussions space, mixed with everything else, rarely getting an official reply. npm is critical infra for millions of developers. It deserves its own dedicated, staffed, public tracker. This isn't optional.

Kevin Deng
@sxzz.dev

Then there are the recent security incidents. Supply chain attacks keep landing on npm, and the responses tend to be slow and opaque. When you operate the registry the world depends on, "we're looking into it" days later isn't accountability. It's risk externalized onto the ecosystem.

0 reposts7 likes

Kevin Deng
@sxzz.dev

So here's the ask: **open source the npm registry** Microsoft acquired npm in 2020. The bar isn't even "make it better." It's "stop making it worse." A closed registry controlled by one company is a structural risk the JS ecosystem shouldn't have to carry.

Kevin Deng
@sxzz.dev

The archived npm-registry-couchapp repo still says: "FOSS is an important part of npm, and over time we plan on exposing more APIs," In 2026, that line reads like a punchline. The repo is archived. The promise is archived. "Over time" never came. github.com/npm/npm-regi...

github.comGitHub - npm/npm-registry-couchapp: couchapp bits of registry.npmjs.orgcouchapp bits of registry.npmjs.org. Contribute to npm/npm-registry-couchapp development by creating an account on GitHub.
Kevin Deng
@sxzz.dev

Credit where it's due. Huge thanks to the @pnpm.io, @npmx.dev, and broader tooling communities (@e18e.dev) You're the reason working with JS packages still feels okay day to day. You filled the vacuum npm left behind. The registry is still a single point of failure, but the tools around it aren't.

Pier
@pierbover.com

It's not only about open sourcing the code. Hosting the npm registry is probably quite expensive too. IMO long term the solution is probably joining the OpenJS foundation.

Kevin Deng
@sxzz.dev

Agreed, just open sourcing the code isn't the answer on its own. The way I see it, open sourcing isn't really about the code being public. It's about activating a community. The community is the point. The repo is just the entry door.

Kevin Deng
@sxzz.dev

That's what issues, PRs and discussions actually mean. When you hit a bug, you can submit a PR and fix it yourself, instead of waiting in the dark for some unknown release date. Right now, the npm feedback loop is broken. You report, you wait, you give up.