I suppose a less anxious view is that we just diversified away from the ecosystem risk from what was looking to be the start of an implosion of npm.

I guess this is the risk of working on a product that could be easily added as a feature to a much more popular product. But, hey, Dropbox is still successful.

I don't worry about npm. I for one can't wait to move to a different registry.

Same. Was hoping this would be an alternative to NPM, but it just builds on top of it

It's an alternative to the NPM registry.

Yes, parent confused me... It is entirely orthogonal from NPM, correct?

It's an alternative registry so it's compatible with yarn and the official npm client. It doesn't seem to rely on any services provided by npm Inc though, so it's a direct competitor.

So.....this is actually good thing that we as a community are not dependent on a single actor?

npm Inc always had a monetisation problem.

The npm registry started out as a hobby project that was eventually backed by the company its creator worked for. He then decided to pull out his project into his own startup, which raised some eyebrows because suddenly it looked like there was a lot of hostility between him and the company that previously footed the bill for little more than marketing value. Also it was completely unclear how the startup was supposed to make enough money to be viable.

Additionally during its "nice people matter" phase npm Inc seemed to be more focussed on creating a nice environment for its employees and maintaining its ethical values than creating anything that might generate a profit.

The two most obvious monetisation options were private packages and enterprise self-hosting. But when private packages had become a thing there were already third-party open source clones of the npm registry that offered this feature (first sinopia, now verdaccio).

There's really no way to monetise the registry itself directly because users simply aren't willing to pay for a service they expect to be free (like maven, rubygems, PyPI, etc). It would have been more logical to create a non-profit (or at this point transferring the registry to the OpenJS Foundation being the more obvious choice) instead of a for-profit startup.

npm Inc was doomed from the start. Even after acquihiring ^Lift to build the security audit feature there's simply no significant value in what npm Inc offers for money compared to what's already available for free.

The recent CEO change feels like a desperate move by the stakeholders to avoid becoming the next RethinkDB (which also ultimately failed to come up with a way to make money other than support licensing, i.e. renting out access to their developer time).

This is what people criticised when npm Inc was initially spawned: investor money isn't free money and having investors doesn't mean you can perpetually operate at a loss. Investors want significant return on investment, at least eventually. That means either selling out by being acquired (and likely killed) or becoming massively profitable (or surviving long enough while generating enough "value" to go public).

A package registry is a cost center that in order to be valuable needs to be practically guaranteed to exist forever. Maybe if GitHub manages to kill npm Inc they'll finally admit this and transfer the registry and client to a non-profit like the OpenJS Foundation.

We were contacted by NPM to switch our Enterprise account from self hosted, to hosted by NPM.

There is two problems with this for where I work.

1. What if NPM goes bust? what happens to our packages? 2. What if NPM gets hacked? what happens to our packages? 3. The increase in price was HUGE.. which was probably the reason for forcing us to migrate to their new cloud hosted option.

Look it's an open secret at this point that NPM is in trouble, it's fired a bunch of staff, other staff have quit. The new CEO is all about profit, and its just the beginning.

Here's what we did.

We spun up a nexus instance https://www.sonatype.com/download-oss-sonatype

It has a NPM plugin, so we get our private repo .. we host it ourselves.. it's exactly what we want.

Honestly if you're an Enterprise customer, this is something to consider

Actually, it has never felt natural to me to publish a Node.js package to two web sites, both Github and NPM. Moreover, when Google lands me on NPM's web site I prefer to navigate right away to Github. If this new thing from Github is going to replace NPM so that there's only one place for that matter - I would not mind.