The Handling Module Name Disputes page explains a particular case: what should be done if you want to use for your package a name which is already in use by a not valuable or never updated package. According to this page, if you can't resolve the dispute with the original author, you should email email@example.com (Isaac Z. Schlueter, the lead developer of
For a more general case of registry control (spam, abuse), the community itself should deal with the issues.
There is a gentle way to deal with minor issues (for example a person who believes that his Hello World is extremely valuable for the community, thus polluting the registry): if nobody downloads the package, statistics would be an excellent indicator that other people should think twice before downloading it.
For more serious problems, contact Isaac.
How reliable is it for production deployment scenarios?
Do you talk about the scenario where third-party packages are updated from
npm through continuous deployment?
In this scenario, the problem of something going wrong is minor:
- Continuous deployment updates the third-party package on server 1,
- Tests are run,
- Test results turn red,
- The original version is restored; the server 1 may come back online now,
- No other servers would be updated. It's now up to the developer to go and see why tests failed.