GitHub Signs Agreement to Acquire npm
GitHub has announced it has signed an agreement to acquire npm, the company behind the JavaScript package registry. The registry currently hosts more than 1.3 million packages and serves roughly 75 billion downloads per month, making it a central piece of the JavaScript ecosystem.
According to GitHub, the public npm registry will remain free and accessible to all developers. The near-term focus after the deal closes is on registry reliability and platform growth, improving the daily experience for developers and maintainers, and increasing community engagement around the project's roadmap.
Projected Work After Acquisition
GitHub's stated priorities include continued investment in registry infrastructure to keep npm fast and scalable as the JavaScript ecosystem expands. On the developer experience side, GitHub says it will support the ongoing work on the npm v7 CLI, which is expected to remain free and open source. Notable features on the horizon include Workspaces and enhancements to the publishing workflow and multi-factor authentication experience.
GitHub also plans to seek community input on future directions for npm, including a Reddit AMA with team members in the coming days.
Integration with GitHub and Security Efforts
Longer-term plans involve integrating GitHub and npm to strengthen the security of the open source software supply chain. The goal is to give developers the ability to trace changes from a GitHub pull request to the specific npm package version that addressed an issue. GitHub points to its Security Lab and built-in security advisories as foundational tools for this effort. Additionally, GitHub is exploring ways to extend its GitHub Sponsors program into the npm ecosystem after having already paid out millions of dollars to open source contributors.
Impact on Paid npm Customers
Payments for npm Pro, Teams, and Enterprise customers will continue. GitHub says it is also investing heavily in GitHub Packages, its multi-language package registry integrated with GitHub. Later this year, npm's paying customers will be able to migrate their private npm packages to GitHub Packages, which would let npm focus its resources on being a public registry for JavaScript.
