npm
JavaScript package registry and enterprise dependency management platform.
Available information varies by company and source.
Profile record updated:
Company facts
- Official name
- npm, Inc.
- Entity type
- COMPANY
- Founded
- 2014
- Headquarters
- United States
- Company size
- 10–49
- Market role
- B2B SaaS Provider
- Official website
- npmjs.com
What npm does
npm creates value by operating the core package distribution and dependency management infrastructure for the JavaScript ecosystem. Free access to the public registry and CLI drives large-scale developer adoption, package publishing and ecosystem dependency on its workflow. That usage converts a portion of organisations into paying customers for private package hosting, team administration, security controls and enterprise governance features, making the open ecosystem the top of the commercial funnel.
Category differentiation
npm is a developer infrastructure and package management company, not a digital advertising, martech or media business. It provides software package registry and enterprise dependency management rather than cloud data warehousing or general-purpose collaboration software.
Strategic context
AI-supported assessment from the existing company research; distinguish interpretation from sourced facts.
npm, Inc. operates the npm Registry, npm CLI and related web and enterprise tooling used to publish, discover, install and manage JavaScript packages. It is a developer infrastructure company owned by GitHub, serving individual developers, open-source maintainers, software teams and large enterprises that rely on JavaScript and Node.js package distribution, dependency management and private package administration. The company uses a freemium model. The public registry and core CLI are free and drive ecosystem adoption, while revenue comes from paid team and enterprise products including private packages, organisation management and enterprise-grade private registry capabilities with security, access control and governance. Its direct paying customers are engineering teams and enterprises, not end consumers.
Company news briefing
Briefing updated:
Following the 'Miasma' supply-chain breach, npm continues to strengthen developer security by enabling .npmrc-based controls, such as minimum package-age requirements, to mitigate risks from insecure AI-generated code. Under Microsoft's 'Project Perception' framework, the registry has consolidated its position as a vital distribution hub for ecosystem tools, hosting packages for OpenAI migration scanners and agentic contract checkers. These secure infrastructure foundations ensure npm remains critical to distributing decoupled agentic harnesses and managing validation risks within the broader GitHub and Microsoft ecosystem.
Business model & monetisation
npm monetises through software subscriptions layered on top of a free public developer utility. The public registry, website and CLI are free for open-source usage and user acquisition. Paid monetisation comes from private packages, organisation accounts and enterprise private registry products sold on recurring contracts to teams and large companies.
- Enterprise private registry and governance subscriptions
- Software Subscription
- Team and organisation paid plans
- Software Subscription
- Free public registry and CLI
Products & capabilities
No products with linked sources are available in this view.
Products & market categories
Recent recorded signals
Dates refer to the source publication. Older entries are historical context, not evidence of a new event.
Why npm and pnpm audit miss vulnerabilities
Supply Chain Security · Recorded impact score: 1/5
This technical article explains why npm and pnpm audit commands can produce conflicting results and miss vulnerabilities. It clarifies that audit is a network request to the registry's audit endpoint, relying solely on the GitHub Advisory Database. The piece identifies four structural gaps: single-source dependency, silent failure without network, npm-ecosystem exclusivity, and lack of reachability analysis or inventory output. The differences between npm and pnpm audit stem from how each resolves the dependency tree and the timing of data. The author recommends a more robust approach: using lockfile-based scanning with aggregated open advisory data like OSV, and producing CycloneDX SBOMs for durable coverage. The article is technical and applicable to developers concerned with supply chain security.
- npm audit and pnpm audit are network requests to a registry endpoint, not local scanners.
- Advisory data for npm and pnpm audit comes from the GitHub Advisory Database.
10 AI Coding Actions Developers Must Always Review
Large Language Models (LLM) & AI · Recorded impact score: 1/5
A developer describes how they use AI to generate code but enforces strict review rules. The article lists ten specific actions the author never allows an AI coding assistant to perform without human verification — including running terminal commands blindly, installing unknown packages, exposing .env secrets, writing authentication or security logic without review, running database migrations immediately, making large project-wide edits, merging code they can't explain, trusting AI-generated tests automatically, letting AI make security decisions alone, and deploying straight to production. The author recommends a simple review workflow (generate, read, understand, test, review diff, then merge) and emphasizes that humans remain responsible for the final result.
- The author uses AI to help generate components, write APIs, fix bugs, explain errors, create tests, refactor code, write SQL, and plan features.
- They list 10 things not to let AI do without checking, including running terminal commands blindly, installing unknown packages, and touching .env secrets carelessly.
Practical Guide to React Performance
Web/App Development · Recorded impact score: 1/5
This technical guide summarizes practical, high-impact techniques for improving React application performance. It advises measuring with the React Profiler and browser performance tools before optimizing, avoiding unnecessary re-renders by stabilizing referential identity (useMemo, useCallback, React.memo), and using code-splitting and lazy loading to ship less JavaScript. The guide recommends moving heavy work to the server with React Server Components (preferring server components for data fetching and static content, and client components for interactivity), and optimizing images and fonts via responsive sizes, modern formats, and lazy loading. The author emphasizes that fixing a small set of common patterns resolves most real-world React performance problems.
- Measure before optimizing using the React Profiler and the browser's performance panel.
- Avoid unnecessary re-renders by stabilizing derived data and callbacks with useMemo and useCallback and by using React.memo for expensive children.
Agent-verification platform recorded false successes
Large Language Models & AI · Recorded impact score: 1/5
A developer postmortem describing bugs found while building AiOps Enabler, a platform that verifies AI agents' performance. Key failures included a generated GitHub Actions workflow that always reported success on a cron schedule, an OIDC binding keyed to repo plus workflow filename that broke reporting when workflows were consolidated, a scoring curve that miscommunicates a high-performing agent as low (e.g., 44/100 despite 100% success), and a CI gating bug that prevented a merged feature from deploying to production. The author outlines architecture choices, the current product surface (SDKs, API, directory), and lessons about verification, testing, and distribution. The article was published 2026-08-27.
- AiOps Enabler is a platform providing public profiles and verified performance records for AI agents.
- The onboarding wizard generated a GitHub Actions workflow that unconditionally reported success every 30 minutes, recording successes even when agents did not run.
Line Bot Fixes 403: npm Drift, Node.js, Cloudflare
Infrastructure · Recorded impact score: 1/5
An engineer debugged a recurring URL-retrieval failure in a Line bot caused by silent npm version drift and mismatched Node.js runtime requirements. The root causes were an unlocked global npm install that pulled a new single-file-cli requiring newer Node APIs (CloseEvent available only in Node 24), and missing detection for Cloudflare challenge pages. Fixes included locking Node.js to NodeSource 24.19.0 and single-file-cli@2.0.83 in the Dockerfile, adding raw-HTML Cloudflare challenge detection to the loader, and adding a Cloud Build verification step that runs the built image against a real target URL. The underlying Cloudflare protection on acm.org still blocks scraping; the changes separate crawler-blocking failures from internal runtime crashes and improve CI runtime verification.
- The failure was caused when an unlocked npm install silently upgraded single-file-cli to a version that required newer Node.js APIs.
- The ws/simple-cdp dependency required a global CloseEvent, which the author found is only available in Node 24 (not Node 22), so Node 24 was chosen.
Explore company relationships
Questions about npm
What is npm?
npm is a JavaScript package registry and package management platform that lets developers publish, discover, install and manage code packages.
Who uses npm?
npm is used by individual developers, open-source maintainers, software teams, DevOps practitioners and enterprise engineering organisations working with JavaScript and Node.js.
How does npm make money?
npm makes money through recurring paid plans for private packages, organisation management and enterprise-grade registry, security and governance capabilities.
Sources & coverage
This profile uses public, official and technically observable information. Missing information does not prove that a product or relationship does not exist. The list below does not imply that every profile statement has been verified.
14 publicly documented primary sources and citations linked across the market graph.
Continue your research on npm
Explorer includes additional company details, a Watchlist for up to 25 companies and your personal Strategic Intelligence Agent. It monitors your market daily and delivers tailored briefings with clear strategic context whenever relevant news occurs.
Free, with no time limit.