Npm is not an acronym, but it is the backbone of modern web development
In short: Created in 2010 to fix inadequate module packaging, npm has grown into a massive registry hosting over 3.1 million JavaScript packages. While it powers the web by enabling efficient code sharing, its lack of a vetting process has turned it into a frequent target for supply chain attacks and malicious actors.
Originally short for Node Package Manager, the name npm is now a recursive backronym for 'npm is not an acronym'. Developed by Isaac Z. Schlueter, it was designed as a lightweight, community-oriented tool for the Node.js runtime, drawing inspiration from PEAR for PHP and CPAN for Perl. By 2014, npm, Inc. was established in Oakland to manage the registry, eventually being acquired by GitHub in 2020. Today, it remains a central infrastructure component for JavaScript, serving billions of downloads regularly.
The registry's open nature is both its greatest strength and its primary vulnerability. Because there is no submission vetting process, npm relies on user reports to remove low-quality or malicious code. This has led to significant security incidents, including the 2016 left-pad incident—where the removal of a single popular package broke major projects like Babel and Webpack—and various supply chain attacks. In 2025, a self-replicating worm called Shai-Hulud compromised over 187 packages, while researchers later identified over 150,000 packages linked to a blockchain token farming campaign.
Despite these risks, npm remains the default package manager for Node.js. Developers use tools like package.json to manage dependencies and semantic versioning to balance updates with stability. While alternatives like pnpm, Yarn, Bun, and Deno offer different client-side experiences focused on performance and determinism, they largely remain compatible with the public npm registry. As of 2026, the ecosystem continues to evolve, with ongoing efforts to improve security and infrastructure in the face of persistent, sophisticated threats from groups like TeamPCP.
The platform's history reflects the broader challenges of open-source software. From the 2018 event-stream bitcoin theft to the 2026 Mini Shai-Hulud attacks targeting companies like OpenAI and GitHub, the registry has become a high-stakes environment. While GitHub has introduced enhancements like improved command-line tooling and better security features, the responsibility for maintaining safe dependencies often falls on the developers who integrate these millions of packages into their own workflows.
Opens the Intellect+ feed with this card first. Swipe up for the next one.
Sources
- Summary by Intellect · source: Npm
To cite this card, link to https://intellectplus.co.uk/app/culture-npm.
How we source, check and correct cards: Editorial standards.
General information, not professional advice. Spotted an error? Flag the card or see corrections and complaints.
Intellect Plus is a visual educational discovery platform for exploring fascinating facts and ideas. Brain Food, Not Brain Rot. What is Intellect Plus?
Related
More in Journalism and mass media · More in Cultures · Latest · A–Z · All topics
