It appears that by publishing, you accept their terms in allowing them to distribute the package [1]. They also say they won't run the code directly (although t

It appears that by publishing, you accept their terms in allowing them to distribute the package [1]. They also say they won't run the code directly (although they may analyze it), which might sidestep certain license issues. My guess is that it's no different than posting it on your own website and having the Internet Archive back it up. (IANAL. Just doing my best to interpret their policy.) [1]: https://github.com/npm/policies/pull/43/files https://github.com/npm/policies/pull/43/files