More important than the namespace is who published the package. I'm more inclined to trust an individual I know who takes security than a namespace that may change hands.
NPM exposes that info in the _npmUser field: https://github.com/npm/registry/blob/master/docs/REGISTRY-AP.... That gives "name" (NPM username) and email.
While there are thousands of packages, I bet there's a much smaller number of publishers to worry about.
Like this guy pretty much has a separate NPM package for every single function that he writes: https://www.npmjs.com/~sindresorhus (1162 packages under his name alone, maybe even more in other namespaces).
In Social engineering campaign targeting tech employees spreads through NPM malwarenpm
registry
Learning & Reference2016–2023
npm / registry
registry
npm registry documentation
16Distinct people
16Mentions
0Explicit recommenders
499GitHub stars
What to know before exploring
What it is
npm registry documentation
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year16 dated mentions
Observed mentions: 2016-06-28 22:54:12 UTC to 2023-07-25 20:03:50 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 11 | 2 | 9 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
📦 npm registry documentation
A collection of archived documentation about registry endpoints/API.
See the registry at https://registry.npmjs.org.
If you're having issues with the website or registry itself please
contact npm's support staff.
Read the full README on GitHubWhat Hacker News says
16 sourcesThey say they've fixed this in this related issue (https://github.com/npm/registry/issues/335) but I can't tell what change was made. The only discussion was around accepting a port number in the Host header. All well and good to fix what I assume was a config bug. But I can't tell if the secondary (but arguably more important) issue of returning valid error messages was addressed. I'm not sure what the exact right error message should have been. If the server was intentionally differentiating host headers with port numbers then probably 400 or possibly 404. But I'm guessing this was just a plain and simple bug and that 418 was set as a cutesy catchall "something unexpected happened" error status to be sent in some exception condition. I hope they've changed that to return 500, which would at least honestly accept blame for the issue.
In NPM proxy users receiving ERR 418 I'm a teapotNot true https://status.npmjs.org/incidents/41zfb8qpvrdj
"We have restored all the package-versions for the 9 packages that were published over"
Full context here https://github.com/npm/registry/issues/255
In Time for developers to address the chaos of Node.js and NPMIt's been almost 2 years since the great left-pad debacle[0]. The last major npm issue[1] was less than 2 months ago. While the underlying npm registry security issues will remain for a while (and other languages don't seem to have these issues with their package managers), there doesn't seem like there's too much I can do other than use yarn. And hope an alternative registry will appear.
Since I 'vote' with my code - this migration page has been helpful today - and I hope it will help others:
https://yarnpkg.com/lang/en/docs/migrating-from-npm/
It took me ~5 mins to migrate all of my code from npm to yarn. But I don't have complex CI tasks either.
I use ncu to check updates every couple of days, sometimes more frequently. To further distance myself from npm, can anyone comment on the pros/cons of github repo paths instead of package name
Read the rest
s in package.json?
[0] https://www.theregister.co.uk/2016/03/23/npm_left_pad_chaos
[1] https://github.com/npm/registry/issues/255
*edit: formatting
The status page at https://status.npmjs.org/incidents/41zfb8qpvrdj says that "We apologize for the temporary unavailability of some packages.".
If this was only a matter of missing packages, this would "only" be a matter of breaking builds.
But it looks like third parties were able to take over the missing packages, see https://github.com/npm/registry/issues/256 - which is a HUGE deal, considering "npm install" blindly executes the scripts in a package's preinstall property (as well as the packaged module itself possibly containing arbitrary backdoors)
In Many packages suddenly disappearedApparently the restore is now complete:
https://github.com/npm/registry/issues/255#issuecomment-3557...
In Many packages suddenly disappearedThere are over 700 comments on this issue on GitHub. It is turning into live chat room.
https://github.com/npm/registry/issues/255
Be part of the history :)
EDIT: there are now over 1100 comments/memes.
In Many packages suddenly disappearedmodule.exports = typeof Promise === 'function' ? Promise : require('pinkie');
I can't even install webpack-dev-server. Because this package is missing.
EDIT: it's back
[1]: https://stackoverflow.com/questions/48131550/nodemon-install...
[2]: https://github.com/npm/registry/issues/255
In Many packages suddenly disappearedSeveral packages just disapperead, now some are re-appearing, potentially uploaded by differnt users (!).
See https://github.com/npm/registry/issues/255 for details.
Very annoying, breaks builds all over, also prevents installing react-native.
In Many packages suddenly disappearedMany packages suddenly disappeared
749 points · Open discussionIs the npm registry still open source?
3 points · Open discussionI'd switch to scoped packages, if not for https://github.com/npm/registry/issues/59
In Announcing Free Orgs at npmIt looks like npm is confusing the download count with another package, 'd' (lowercase)[0]. I didn't realize that npm packages were case-sensitive, and apparently neither does their download counter!
Edit: Apparently there is a Github issue for this[1]
[0]: https://www.npmjs.com/package/d
[1]: https://github.com/npm/registry/issues/38
In The owner of several 1 letter NPM packagesShowing the 15 most recent of 16 sources. Enable JavaScript to search and browse every indexed mention.