npm

npm is the invisible infrastructure of the modern JavaScript ecosystem. Founded in 2009 alongside Node.js itself, the npm registry has grown into the world's largest software package registry, hosting over 2.5 million packages that are downloaded more than 100 billion times per month. When npm's registry goes down, it doesn't just inconvenience individual developers — it blocks CI/CD pipelines, Docker builds, and deployment workflows across millions of software projects worldwide. The 2016 left-pad incident — when a single 11-line package was unpublished and broke thousands of builds globally — remains one of the most famous demonstrations of how deeply JavaScript depends on this centralized infrastructure.

Acquired by GitHub in 2020 (and thus now under Microsoft's ownership), npm has invested heavily in reliability improvements since the days of its most notorious outages. The registry is served through a CDN with global edge caching, meaning most "npm install" operations hit cached package tarballs rather than the origin. However, publishing new packages, resolving new package versions, and certain metadata lookups must hit origin infrastructure, and authentication for private registry access introduces additional dependencies. Enterprise customers using npm Organizations or private scoped packages have higher reliability exposure than developers using only public packages.

The failure modes that surface during npm registry issues: "npm install" hanging after resolving the dependency tree and then failing with ETIMEDOUT or ECONNRESET, "npm publish" returning 503 errors preventing new package releases, "npm login" failing to authenticate despite correct credentials, the npmjs.com website returning 502 errors when browsing package pages or searching for packages, private scoped package installations failing with 404 even though the package exists and credentials are valid, and "npm audit" failing to fetch vulnerability data from npm's advisory database.

Outage.gg monitors npm registry status. For engineering teams whose CI pipelines can't proceed without successful package installation, the live status page provides immediate confirmation of whether npm is the bottleneck.