httpsregistrynpmjsorg

The npm registry is the public repository for Node.js packages published to the npm ecosystem. Hosted at registry.npmjs.org, it provides the central source of package metadata, version history, and the distributable tarballs that developers install with the npm command-line client or other package managers. The registry stores information about each package version, including its dependencies, license, authors, repository URL, and integrity data.

Access to the registry is via HTTPS. The npm CLI communicates with the registry to publish new packages, update existing ones, search for packages, and install dependencies. Each package entry supports multiple versions, and dist-tags such as latest or next point to specific versions. Packages can be public, which are accessible without authentication, or private, which require an access token and appropriate permissions typically managed through an organization or paid plan. The registry also supports scoped packages, named with a scope like @scope/package, enabling organization-wide packages and access control.

Packages are published as tarballs along with JSON metadata. The registry uses semantic versioning for versioning, and dependency information in each version controls what is installed. Integrity can be verified via checksums, helping ensure downloaded tarballs have not been tampered with. Developers typically discover packages on the npm website (www.npmjs.com) and install them through the registry, benefiting from metadata such as usage notes, maintainers, and change logs.

Governance and operation: the registry is maintained by npm, Inc., which was acquired by GitHub in 2020 and is part of the GitHub/Microsoft ecosystem. The registry.npmjs.org remains the primary backend for package discovery and distribution in the Node.js community.