npm Registry

The npm registry is the default package registry for Node.js and the JavaScript/TypeScript ecosystem — the largest software registry in the world by package count. Its listings are packages that developers install into their projects with npm install, spanning frameworks, libraries, build tools, CLIs, and AI/agent SDKs. Publishing is famously low-friction: npm publish uploads a package, with scoped packages defaulting to private and an explicit flag required to make a scoped package public.

Authentication centers on access tokens. Interactive publishing requires two-factor authentication by default, and CI publishing uses granular access tokens — or, in the modern recommended approach, OIDC-based trusted publishing, which mints short-lived scoped credentials during CI runs and eliminates long-lived tokens. There is no commerce layer: public packages are free to publish and consume, and npm's paid tiers exist to host private packages and org features rather than to sell packages. Trust and safety rely on account/token security plus automated malware and secret scanning with reactive takedowns, not upfront review.