GitHub announces it has signed an agreement to acquire npm, which is home to 1.3M+ JavaScript packages with 75B downloads per month, says it will remain free
GitHub's deal for npm is its first major platform acquisition since Nat Friedman took over as CEO following Microsoft's $7.5B buyout of GitHub, and it hands the company control of the default dependency layer for JavaScript — 1.3M+ packages and 75B downloads per month that most web development flows through. The commitment that npm stays free signals this is about owning developer infrastructure, not monetizing the registry directly.
The later record shows what that ownership was used for: once npm sat inside GitHub, the registry became an enforcement point for supply-chain security, from [[a:975654|mandatory two-factor authentication for the maintainers of npm's 100 most popular libraries]] to package signing built with Sigstore.
First-order effects
npm's maintainers and the JavaScript ecosystem's dependency chain now answer to GitHub instead of an independent registry operator, with the free tier preserved but policy set by Friedman's team.
GitHub folds package publishing into the same account and tooling surface as code hosting, making the registry a native feature rather than a third-party service developers bolt on.
Second-order effects
Rival registries and package managers face pressure to match GitHub's integrated hosting-plus-packages bundle or cede the default position in JavaScript workflows.
With the registry under one roof, security policy can be pushed ecosystem-wide at once — the mechanism behind the later top-100 maintainer 2FA mandate and Sigstore signing support.
Third-order effects
If the pattern holds, open-source infrastructure consolidates into a few large platforms that treat registries as security enforcement points, concentrating both investment and single-point-of-failure risk in corporate hands.
The trend: Critical open-source infrastructure is being absorbed into large developer platforms, which then use registry ownership as their main lever for supply-chain security.
Interesting thing about Microsoft's big acquisitions under Satya; MineCraft, LinkedIn & Github, is that they execute as autonomous companies right down to acquisitions. Headlines aren't Microsoft buys npm, it's Github buys npm. Same for LinkedIn & Glint. https://github.blog/...
I made a great many mistakes at npm and while there isn't a great deal I can do to fix them at least now I can say I definitely didn't fuck up JavaScript forever.
Interesting. @Microsoft now owns my entire dev stack, especially for writing JavaScript. 🔘 Write code with VS @Code 🔘 Test code with @TypeScript 🔘 Open-source with @GitHub 🔘 Deliver code with @npmjs I hope npm improves even further as GitHub did. Free Pro accounts? 😉 https://twit…
⚡️@npmjs is being purchased by @github! The public registry will remain public, free, and as available as ever. More in this latest blog post.. https://blog.npmjs.org/...
TFW you've been bought by Microsoft but you just can't bring yourself to say “we've been bought my Microsoft.” (Microsoft bought npm. Hooray.) https://blog.npmjs.org/...
Big news! We're excited to announce that @npmjs will be joining @GitHub! We're thrilled to join an organization as committed to open source as we are, so that the npm registry can remain free & public forever. You can read more about this new chapter here: https://blog.npmjs.org/…
- hosts the entire open-source ecosystem via @GitHub - hosts the entire JavaScript ecosystem via @npmjs - has a presence on a huge portion of developer machines via @code - is changing how we develop with JavaScript via @typescript Microsoft basically owns JavaScript now. https:/…