PPlatformAppStores

npm Registry

Developer Tools

GitHub, Inc. · Developer tools & code hosting

Best for: Distributing JavaScript/TypeScript libraries and CLI tools to the Node ecosystem.

Overview

The npm registry is the default package registry for Node.js and the JavaScript/TypeScript ecosystem — the largest software registry in the world by package count. Its listings are packages that developers install into their projects with npm install, spanning frameworks, libraries, build tools, CLIs, and AI/agent SDKs. Publishing is famously low-friction: npm publish uploads a package, with scoped packages defaulting to private and an explicit flag required to make a scoped package public.

Authentication centers on access tokens. Interactive publishing requires two-factor authentication by default, and CI publishing uses granular access tokens — or, in the modern recommended approach, OIDC-based trusted publishing, which mints short-lived scoped credentials during CI runs and eliminates long-lived tokens. There is no commerce layer: public packages are free to publish and consume, and npm's paid tiers exist to host private packages and org features rather than to sell packages. Trust and safety rely on account/token security plus automated malware and secret scanning with reactive takedowns, not upfront review.

How to build & ship

  1. 1Create an npm account and (recommended) enable 2FA
  2. 2Initialize the package with package.json (name, version, entry points, files)
  3. 3Build/transpile and set exports/types; test the packed tarball with npm pack
  4. 4Log in (npm login) or configure OIDC trusted publishing from CI
  5. 5Run npm publish (scoped packages need --access public) with 2FA or short-lived OIDC creds
  6. 6Publish provenance attestations (--provenance or automatic via trusted publishing)

Key APIs & SDKs

npm CLI (publish, pack, dist-tag)
npm registry HTTP API
OIDC trusted publishing (GitHub Actions / GitLab CI)
Provenance / SLSA attestations (Sigstore)
package.json manifest (exports, files, bin)

Integration types

Connector

Authentication & security

  • Primary auth: PAT
  • Also supports: OAuth 2.0, JWT
  • Security review: Not required
  • No pre-publication human review; the registry relies on 2FA/token controls, automated malware and secret scanning, and reactive removal.
  • There is no human review before publishing; packages go live immediately and are policed after the fact via automated malware/abuse scanning, security advisories, and takedowns.
  • Registry and API request limits are not publicly documented as fixed numbers; abuse controls apply.
Auth docs Store policies

Monetization

Free
Onboarding
$0
Commission
0% (paid tiers cover private packages, not per-package sales)
Merchant of Record
None

Pros & cons for builders

Pros

  • The default JavaScript/Node registry with enormous reach
  • Instant, self-service publishing via a single CLI command
  • Modern supply-chain security: OIDC trusted publishing and provenance
  • Free public hosting and scoped-package namespaces

Cons

  • No upfront review enables typosquatting and malicious-package attacks
  • Dependency-tree sprawl amplifies supply-chain risk downstream
  • Name squatting and unpublish restrictions can complicate naming

Frequently asked questions

How do I get my app approved on npm Registry?

There is no human review before publishing; packages go live immediately and are policed after the fact via automated malware/abuse scanning, security advisories, and takedowns.

What authentication does npm Registry use?

npm Registry apps primarily authenticate with PAT, also supporting OAuth 2.0, JWT.

How is npm Registry monetized?

npm Registry supports Free. Typical commission: 0% (paid tiers cover private packages, not per-package sales). Onboarding fee: $0.

Is a security review required to list on npm Registry?

No, npm Registry does not require a formal security review before listing.