Post

npm increasingly feels like a zombie org under GitHub. As someone who's been around the JS ecosystem and part of multiple OSS orgs for years, what I'm seeing isn't just "big co moves slow." It's quiet neglect of critical infrastructure the entire JS world runs on. A short thread 🧵

One concrete example. This issue on npm/cli: github.com/npm/cli/issues/8768 Open for six months. Zero official replies. It's not an outlier, it's the pattern. Real users posting real bug reports, just sitting there with no response from anyone at npm.

The npm registry has no proper issue tracker. Feedback gets dumped into a GitHub Discussions space, mixed with everything else, rarely getting an official reply. npm is critical infra for millions of developers. It deserves its own dedicated, staffed, public tracker. This isn't optional.

Then there are the recent security incidents. Supply chain attacks keep landing on npm, and the responses tend to be slow and opaque. When you operate the registry the world depends on, "we're looking into it" days later isn't accountability. It's risk externalized onto the ecosystem.

So here's the ask: **open source the npm registry** Microsoft acquired npm in 2020. The bar isn't even "make it better." It's "stop making it worse." A closed registry controlled by one company is a structural risk the JS ecosystem shouldn't have to carry.

The archived npm-registry-couchapp repo still says: "FOSS is an important part of npm, and over time we plan on exposing more APIs," In 2026, that line reads like a punchline. The repo is archived. The promise is archived. "Over time" never came. github.com/npm/npm-regi...

Credit where it's due. Huge thanks to the @pnpm.io, @npmx.dev, and broader tooling communities (@e18e.dev) You're the reason working with JS packages still feels okay day to day. You filled the vacuum npm left behind. The registry is still a single point of failure, but the tools around it aren't.

One last thing, more personal. Going through pages of broken links from the old npm community, the thought that keeps hitting me: this community is dead. Not slow. Not neglected. Dead. @github.com, @microsoft.com, @npmjs.bsky.social team: open the registry. Staff the trackers. Show up. /end

Yeah, I’d have expected more people to switch to jsr.io 🤷🏾‍♂️

`npx jsr publish` literally downloads a Deno binary under the hood. The actual publish logic lives in Deno, not the JSR CLI. So when "JSR CLI" misbehaves, the fix often has to land in the Deno repo. That's not what a neutral, ecosystem wide registry should look like to me.

Yeah, although that all sounds fixable if enough people were interested, at least that what this sounds like? jsr.io/docs/governa...

I created an issue on JSR, but unfortunately, nine months have passed and I still haven't received any official response. Maybe I should go to the Deno main repo and open an issue instead. github.com/jsr-io/jsr-n...