GitHub Inc, which is owned by Microsoft and operates as an independent business unit, has successfully completed the acquisition of NPM Inc, which oversees the development of the NPM package manager and maintains the NPM repository. The NPM repository serves over 1.3 million packages used by around 12 million developers, with approximately 75 billion downloads recorded each month. The deal's amount is not disclosed.
, the CTO of NPM Inc, on his decision to leave the NPM team to take a break, reflect on his experience, and explore new opportunities (in his , it appears that he has taken the position of CTO at Fractional). Isaac Z. Schlueter, the creator of NPM, will continue to work on the project.
GitHub has promised that the NPM repository will always remain free and open to all developers. GitHub identified three key areas for future development of NPM: community engagement (taking into account the opinions of JavaScript developers in service development), expanding core functionalities, and investing in the development of infrastructure and the platform. The infrastructure will evolve in the direction of enhancing reliability, scalability, and performance of the repository.
To enhance the security of package publishing and delivery processes, integration of NPM into the GitHub infrastructure is planned. This integration will also allow using the GitHub interface for preparing and hosting NPM packages — changes in packages can be tracked in GitHub from the time of pull request submission to the publication of a new version of the npm package. The tools provided in GitHub vulnerabilities and about vulnerabilities in repositories will also apply to NPM packages. To fund the work of maintainers and authors of NPM packages, the service .
The development of NPM's functionality will focus on increasing the convenience of everyday work with the package manager for developers and maintainers. Notable anticipated features in npm 7 include workspaces ( — enabling the aggregation of dependencies from multiple packages for their installation in one step), improvements in the package publishing process, and enhanced support for multi-factor authentication.
It should be noted that last year NPM Inc experienced a leadership change, a series of employee layoffs, and the search for investors. Due to the uncertainty surrounding the future of NPM and a lack of trust that the company would advocate for the community rather than investors, a group of employees led by the former CTO of NPM a package repository . The new project aims to eliminate the dependency of the JavaScript/Node.js ecosystem on a single company that completely controls the development of the package manager and maintenance of the repository. According to the founders of Entropic, the community lacks levers to hold NPM Inc accountable for its actions, and the profit-driven focus hinders the realization of primary community-oriented opportunities that do not generate revenue but require additional resources, such as support for digital signature verification.
Source: opennet.ru
