4 ms·

I mean, depends on who puts it there? If the contributors list their emails knowingly for that purpose, that's one thing. If a tool leaks your NPM account email

I mean, depends on who puts it there? If the contributors list their emails knowingly for that purpose, that's one thing. If a tool leaks your NPM account email, which you have no control over, that's not exactly transparency. You can see the Collaborator's NPM profile, where _they_ can set handles to contact them at. You can also get to their GitHub profile where they also can set handles to contact them at. If the tool made it easier to see those, then great. These emails don't appear to be directly listed on NPM's website. Or correlated with Github/NPM profile. My guess is they're surfacing the email associated with that user's NPM account? Which is not otherwise obviously listed. And the only way you could control it is by also affecting who is an owner of the NPM project itself. If that is the case, then contributor's emails are being 'leaked' without their say-so or probably knowledge, and without any particular way of managing it. Meanwhile they've already listed perfectly good ways of being 'reachable'.

NoNameProvided 5y ago
> If that is the case, then contributor's emails are being 'leaked' without their say-so or probably knowledge When you login into the NPM CLI it printed in all caps that the given email address will be public. I don't like this either about NPM, but it's not like they are leaking in, they are upfront about it and warn you that the registered email address will be accessible to anyone in the package metadata.
- nighthawk454 5y ago
  Yes, that is totally true. That's kinda what I was going for putting 'leaked' in quotes. It's not really leaked because the data is technically public. You can of course scrape it from say: https://registry.npmjs.org/react https://registry.npmjs.org/react However, it's been made significantly more accessible in a tool like this. NPM doesn't list it prominently in their UI anywhere (I believe). So the 'leak' is up-publicizing data outside of the control of the owner, and when other, intentional (and likely better) alternatives exist.

NoNameProvided 5y ago

> If that is the case, then contributor's emails are being 'leaked' without their say-so or probably knowledge When you login into the NPM CLI it printed in all caps that the given email address will be public. I don't like this either about NPM, but it's not like they are leaking in, they are upfront about it and warn you that the registered email address will be accessible to anyone in the package metadata.

nighthawk454 5y ago
Yes, that is totally true. That's kinda what I was going for putting 'leaked' in quotes. It's not really leaked because the data is technically public. You can of course scrape it from say: https://registry.npmjs.org/react https://registry.npmjs.org/react However, it's been made significantly more accessible in a tool like this. NPM doesn't list it prominently in their UI anywhere (I believe). So the 'leak' is up-publicizing data outside of the control of the owner, and when other, intentional (and likely better) alternatives exist.