If NPM wants to stay relevant and a serious contender, they need to have more clear policies in case of IP issues. In this case, the companies weren't even in the same space. Republishing someone's package who has chosen to unpublish and leave your platform is akin to Facebook resurrecting a Facebook profile because they had a lot of friends and the social circle ripple effects would be too high for feed quality for other users, so they chose to reactive the account AGAINST the author's wishes. WHAT?!?
We need an open source NPM alternative, yesterday.
> We need an open source NPM alternative, yesterday.
NPM is open source.[1] You don't want an open source NPM, you want a distributed consensus NPM where nobody has absolute power to censor or destroy other peoples work.
It seems like a prime use case for a DHT, possibly with some blockchain functionality identifying ownership of namespaces that people can reserve, like namecoin.
I was referring to NPM as in the npmjs.org project, with is a repository, user management platform, etc.
Very interesting suggestion in creating a blockchain NPM hosted alternative, with namespace ownerships.
As best I can tell, before NPM restored it, Azer had transferred ownership to somebody else, who wanted to republish the old version but couldn't. So they do appear to be respecting the maintainer's wishes.
That's not how the dependencies in npm work, for most who explicitly replied on owner/project-name notation. Even worse, when unpublished, someone (i.e. malicious actor) could have registered a global name for this or one of many hundreds of packages he wrote, and inject malicious code in all projects from babel to react to my side projects. NPM really got caught with their pants down on this one, and veered into the wrong by opting to unbreak tens of thousands of packages vs. doing the right thing.
