npm

Why it is on our lists

The registry everything JavaScript depends on, and a supply chain with a long history of incidents. Lockfiles and provenance are not optional here.

This is our editorial opinion, not a rating, a score, or data from anyone else.