@happyborg Setting GitHub aside, I just can't understand why npm still isn't a non-profit foundation. And why the JavaScript community just lets it happen.
Discussion
Loading...
@hongminhee I knew that the state of dependency management in JS was bad but I didn't know it was single-vendor, "hey that's a nice library, be a shame if it couldn't be distributed" bad.
@hongminhee they keep folk on such platforms because we don't factor in the longer term costs that they will inevitably make us bear as they slowly ratchet up the money flows.
It's the same everywhere and is very hard to make the case to suffer higher ongoing costs and inconvenience in order to avoid the nebulous future costs and difficulties of dependency on a gorilla wise only goal is to extract as much as possible from you.
@happyborg Setting GitHub aside, I just can't understand why npm still isn't a non-profit foundation. And why the JavaScript community just lets it happen.
@hongminhee
> I just can't understand why npm still isn't a non-profit foundation
I can't understand why anyone keeps using npm despite their ongoing inability to avoid delivering malicious software from their repos;
https://thehackernews.com/2025/12/27-malicious-npm-packages-used-as.html
They have one job; reviewing the code they host, and the maintainers of that code, for quality control. They fail constantly.
@hongminhee unless someone makes it happen it can't happen, and it's not an easy task.
I'm so pleased that there are people who can and do do these things though. So I support Codeberg for example and had a good go at moving my (rather minimal) CI over. I was nearly there but didn't have time to complete it, so everything except release builds (Rust, Svelte + Rust, CLI and Tauri) happens on #Codeberg.
@hongminhee Did not know that it was owned by GitHub. That is sad.
@bart Yeah, npm and GitHub are owned by Microsoft…
@hongminhee I've always been annoyed that deno land's login only option was through a GitHub auth (at least last I checked). I take it that carried over to JSR?
@teleclimber It looks like JSR is trying to add GitLab login support recently, but the options are still too limited.