NPM's docs say that anyone can call npm-publish and add his own NPM package to the "official" registry.

Who controls this registry?

How reliable is it for production deployment scenarios?

What's preventing people from spamming this registry? Is there any moderation/QA process?


The Handling Module Name Disputes page explains a particular case: what should be done if you want to use for your package a name which is already in use by a not valuable or never updated package. According to this page, if you can't resolve the dispute with the original author, you should email i@izs.me (Isaac Z. Schlueter, the lead developer of npm).

For a more general case of registry control (spam, abuse), the community itself should deal with the issues.

  • There is a gentle way to deal with minor issues (for example a person who believes that his Hello World is extremely valuable for the community, thus polluting the registry): if nobody downloads the package, statistics would be an excellent indicator that other people should think twice before downloading it.

  • For more serious problems, contact Isaac.

How reliable is it for production deployment scenarios?

Do you talk about the scenario where third-party packages are updated from npm through continuous deployment?

In this scenario, the problem of something going wrong is minor:

  • Continuous deployment updates the third-party package on server 1,
  • Tests are run,
  • Test results turn red,
  • The original version is restored; the server 1 may come back online now,
  • No other servers would be updated. It's now up to the developer to go and see why tests failed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.