3 ms·
Ask HN: Should we talk about NPM Inc?
NPM registry holds almost all JavaScript packages distributed on the web and is also bundled with all official Node.js distributions. On surface it seems like a very good service but NPM is not truly open source and is not governed by an open government model.
NPM Inc has direct control of npm CLI which has led to a lot of frustration. npm CLI is not maintained properly and there are many bugs that the company refuses to fix, even when patches are submitted! This is all because, unlike Node.js itself they have the full control over this software and don't let the community make decisions for its future. All this frustration has led to birth of Yarn but Node.js is still being packaged with npm CLI which is a client for a FOR PROFIT company registry.
I remember when everyone was very concerned that Joyent having too much control over how Node.js is being developed and maintained. But for some reason the same logic does not apply to NPM Inc. Why is that?
- mikestoltz 9y agoI've been intending to write a post about this for some time. I think it is a huge issue that is constantly passed over by the Node community. NPM is a for profit company that literally bullies the Node.js project to go its way. This happened earlier this year and to me was a blatantly obvious use of this power: https://github.com/nodejs/node/issues/11835 https://github.com/nodejs/node/issues/11835 . Within four comments on the discussion, it became totally taken over by NPM employees who manhandled the discussion and shut down every idea any one had on the matter as being awful. To me personally, it would make much more sense for Node to have a registry schema that anyone could implement from and then any of those package managers could easily be used just by pointing a node install command at it. Albeit for the most part everyone would still be using NPM (there is no doubt it is a fantastic package manager that does a lot great things), but in that circumstance Node retains the power and decision making as far as design and practices instead of just doing NPM's bidding.