HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
npm
policies
Shell2015–2020
npm / policies · Archived

policies

Privacy policy, code of conduct, license, and other npm legal stuff

7Distinct people
7Mentions
0Explicit recommenders
69GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Privacy policy, code of conduct, license, and other npm legal stuff

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year7 dated mentions

Observed mentions: 2015-10-31 22:54:43 UTC to 2020-05-09 14:16:29 UTC.

0123452015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments20172018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2020

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC101
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC505
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC000
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC101

What Hacker News says

7 sources
They are not morally superior to others. They just have more ownership over open source projects. They can decide what project roadmap is, they can spam your terminal with ads[1] and they can even remove or abandon the project. Only people that feel that they are morally superior would go to project issue tracker or public forum and tell maintainer what they can do with their own project. If you do not like it, you can stop using material-ui. At least stop naming people assholes just because they disagree with you. Olivier Tassinari created one of the highest quality react UI toolkit used literally by everybody. My interactions with him on issue tracker were always positive. [1] https://github.com/npm/policies/blob/master/open-source-term...
In Ask HN: What's the greatest lie of open source?
This concern is indeed not addressed in the text I cited. However, though my English reading comprehension isn't precisely the best either, I'm pretty sure this concern wasn't brought up in your comment that I was replying to when citing that text. I don't see this concern addressed in their Package Name Disputes document at all: https://www.npmjs.com/policies/disputes Perhaps they'd be delighted if you brought it up in the public forum they linked to at the end of the blogpost? https://github.com/npm/policies/issues/44
In Changes to Npm's unpublish policy
I grow more and more confused about this. Here are some quotes from their terms of use, taken verbatim from https://docs.npmjs.com/policies/open-source-terms: Some language was changed recently - the diff for the current version of their open source policy is online [0]. > Nothing in this Agreement gives npm any ownership rights in intellectual property that you share with npm Services, such as your Account information or any Packages you share with npm Services (Your Content). Makes sense. Your code is your code. > Your Content belongs to you. You decide whether and how to license it. But at a minimum, you license npm to provide Your Content to users of npm Services when you share Your Content. That special license allows npm to copy, publish, and analyze Your Content, and to share its analyses with others. This doesn't specify irrevocab
Read the rest
le, nor clarify how that license could be revoked by the content owner. > When Your Content is removed from the Website or the Public Registry, whether by you or npm, npm's special license ends when the last copy disappears from npm's backups, caches, and other systems. This seems deceitful. What exactly does "when the last copy disappears" mean? Seems to me that "perpetual backups" would effectively make their "special license" perpetual. Speaking of "special license", they really need to have an attorney write this up. > Other licenses, such as open source licenses, may continue after Your Content is removed. Those licenses may give others, or npm itself, the right to share Your Content with npm Services again. Fair enough, and implies that if my license doesn't give them that right, that unpublishing the code should revoke their "special license". > Either you or npm may terminate this Agreement at any time with notice to the other...The following provisions survive termination of this Agreement: "Your Content", "Feedback", "Indemnity", "Disclaimers", "Limits on Liability", and "General Terms" So ... I can terminate the agreement, but that doesn't actually terminate anything? Don't get me wrong, I feel that npm serves an important function in the community, but as this drama continues to unfold, I find myself trusting them less and less. [0]: https://github.com/npm/policies/commit/140ed66e2169e248674fe...
In Changes to Npm's unpublish policy
It appears that by publishing, you accept their terms in allowing them to distribute the package [1]. They also say they won't run the code directly (although they may analyze it), which might sidestep certain license issues. My guess is that it's no different than posting it on your own website and having the Internet Archive back it up. (IANAL. Just doing my best to interpret their policy.) [1]: https://github.com/npm/policies/pull/43/files
In Changes to Npm's unpublish policy
> Because all dependents are satisfied by 1.0.1, support agrees to grant Supreet’s request to delete 1.0.0. There are some good changes here, unfortunately this policy will still break projects that use "npm shrinkwrap" to lock down specific versions, which IMHO, anyone who wishes to retain their sanity will do. When this happens AFAIK there's no foolproof way to "patch" your npm-shrinkwrap.json with the new version without deleting it and re-running shrinkwrap, and thus possibly bumping versions of every other package as well. The usual recommendation seems to be "find and replace" the version in npm-shrinkwrap.json with a regex, which is fine if the package's dependencies didn't change but will break if a dependency is added. I'd love to know if there's a better way. FWIW, if you think this is a very rare occurrence, it's now happened t
Read the rest
o me 3 times in last few months, the latest being less than a week after the left-pad incident [1]. 1. https://github.com/chalk/ansi-styles/issues/15 2. GitHub issue with additional discussion here: https://github.com/npm/policies/issues/44
In Changes to Npm's unpublish policy
I am a deals attorney and a programmer. I'd caution against conflating comparison tools like "diff" with Git and revision control more generally. Lawyers call change sets "redlines" rather than "diffs". Their use in the profession long predates modern computing. Word has a serviceable built-in diff tool called "Compare Documents", and many law firms license superior document comparison software. Prose diff is hard, and specialized law tools far surpass diff, wdiff, GitHub prose diff, &c. in areas like move detection and treatment of punctuation. Source code revision control systems are built for, and conducive to, modes of collaboration that only occasionally resemble legal practice. In the main, lawyers trade "patches" with commentary via e-mail, which is still the practice of some important open-source projects, like Git itself. (For a
Read the rest
nice comparison of this workflow to "GitHub flow": http://zachholman.com/posts/git-commit-history/ . See also git-send-email and git-format-patch.) A developer might be tempted to squash commits to make a "pretty" patch. In an adversarial negotiation, hiding incremental revision history is essential for maintaining confidentiality and information advantage. If you're going to squash, anonymize, remove timestamps, &c. every time, Git is overhead and potentially dangerous. Git's architecture does not allow parallel, private histories for shared commits; you can't have your secrets and share them, too. Fortunately, there are two common situations where Git makes sense for legal docs: standard forms and public terms. GitHub is in active use in both those areas. A few pioneers, among them Jason Boehmig, whose Ironclad is a recent YC alum, and Casey Kuhlman, now of Eris Industries, have done work on "open" form contracts in plaintext markup tracked with Git. Jason lead the effort to make the Series Seed financing documents available on GitHub: https://github.com/seriesseed/equity I've followed in Jason's footsteps with an in-development community revision of Series Seed at https://github.com/seriesnext/seriesnext and an experimental company-to-company NDA at https://github.com/obviousnda/obviousnda (More announcements in this vein to come.) Casey's "Legal Markdown" and later writing for Eris were big inspiration for my current open-source work. Public terms, like terms of use, fall somewhere in between working on a standard form for the common good and negotiating a contentious agreement. On the one hand, what's good for the service provider may come at user expense, as with arbitration clauses or limits on liability. On the other hand, courts require that users at least have notice and a way to review changes made, and transparency goes a long way to earning user trust and avoiding PR blow-up. When the users on the other side are devs, Git makes a lot of sense. A number of developer-tools companies use version control to track their privacy policies, and sometimes other company policies. npm, Inc.'s policies, to give one example, are here: https://github.com/npm/policies Many of these use GitHub's "prose diff" support for Markdown. If you're interested in terms of use, privacy policies, and the like, I've written about how my open-source work on "Common Form" (https://commonform.github.io), a schema and content-addressing system for modular legal documents, will apply to those terms: http://writing.kemitchell.com/2015/08/24/TOS-Already-Read.ht...
In Arbitration Everywhere, Stacking the Deck of Justice

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.