Unlike Maven Central or almost every other package registry in the world, NPM is operated by a venture capital founded startup (npm Inc). So, yeah, their prior

Unlike Maven Central or almost every other package registry in the world, NPM is operated by a venture capital founded startup (npm Inc). So, yeah, their priorities are very different and that leads to questionable technical decisions. A number of prominent ex-employees have collaborated on a new, federated package repository called Entropic. Frankly, I hope they succeed and npm Inc meets its inevitable fate.