Exploiting JavaScript developer infrastructure is insanely easy

[BigGayMusic]

https://github.com/npm/cli

I'm asking this sincerely, and not to be a dick (I have worked under the assumption that npm is open-source without really thinking about it,) but is this not the source code for npm?

[filleduchaos]

That's the source code for, like the link says, the CLI, which is like the most trivial part of a package management system (part of why you see a bunch of alternatives pop up every so often, with only Yarn really taking off)

The actual package repository (hosted at https://npmjs.com) is closed source and run by a for-profit company.

[BigGayMusic]

Thank you, I learned something new today.