NPM's Current State and Limitations

• NPM was major innovation for package management, massive improvement over pip/gems
• Since Microsoft acquisition (GitHub → Microsoft), has sustained but lacks innovation
• No meaningful new features in years despite close monitoring
• Competition historically difficult due to:
  • NPM bundled with Node
  • Expensive hosting/distribution costs
  • No revenue model (users don't pay)

New Registry Competitors Overview

• Two new registries emerging (not package managers, but registries)
• Current package managers (bun, pnpm, yarn) still use NPM registry
• JSR: Created by Deno team (Ryan Dahl - original Node creator)
• Vault: Created by Isaac (original NPM creator)
• Represents "Node vs NPM" battle at registry level

JSR (JavaScript Registry) Features

TypeScript-First Design

• Built specifically for TypeScript and ESM
• Publishing TypeScript packages with type definitions traditionally chaotic
• Requires external engineer help for complex setups (example: upload thing project with Julius)
• JSR handles:
  • API docs generation
  • DTS files generation
  • Code transpiling for cross-runtime compatibility
  • Web standard ECMAScript modules distribution

Documentation Generation

• Automatic API docs from TypeScript source
• Similar to TS.dev functionality for type definition visualization
• Example: React Router DOM type definitions display
• Generated from JSDoc comments and proper type definitions
• Day-one feature vs external tools

NPM Compatibility

• Superset of NPM, not replacement
• Works with any JS package manager (yarn, pnpm)
• Compatible with any runtime (Node, Deno, Bun, Cloudflare Workers)
• JSR modules can import NPM dependencies

Slow Types Limitation

• JSR analyzes TypeScript source for documentation/type generation
• "Slow types" not supported in public API:
  • Types requiring extensive inference
  • Complex types that are computationally expensive
• Consequences of slow types:
  • 2-5x slower type checking (potentially higher)
  • No type declarations for NPM compatibility
  • Missing/degraded documentation
  • Types replaced with 'any' in generated declarations

JSR Motivations and Benefits

Modern Web Standards

• ECMAScript modules as standard (not CommonJS)
• Multiple JS runtimes beyond Node/browsers
• TypeScript as de facto standard
• Addresses requirements that didn't exist when NPM created

Key Features

• Native TypeScript support across runtimes
• ESM-only approach (breaking from CommonJS)
• Cross-runtime support focus
• Interoperability with NPM-based projects
• Enhanced developer experience:
  • Single command publishing
  • CI integration walkthrough
  • Zero-config GitHub Actions publishing
  • Automatic DTS files for Node/NPM
  • TypeScript best practices guidance
• Fast, secure, reliable infrastructure
• Resource-constrained environment optimization

Vault Technologies Overview

Team Composition

• Isaac: Original NPM creator, former NPM CEO, GitHub principal engineer, Node project leader
• Darcy Clark: Staff engineering manager (NPM, GitHub CLI teams), Themify co-founder
• Roy Adoro: Node.js TSC member, Google staff software engineer, former NPM CLI team lead

Investment and Support

• Led by Excel Ventures
• Notable angel investors:
  • Guillermo Rauch (Vercel)
  • Evan You (Vue creator)
  • Pete Hunt (React contributor, Excalidraw)
  • David Kramer
  • Zach Jackson (Remix team)

Mission Statement

• Focus on developer platforms and tooling
• Address package ecosystem stagnation
• Improve developer experience
• Wealth of innovation opportunities identified

Security Concerns Highlighted

Manifest Confusion Attack Vector

• NPM package manifest published separately from tarball
• Manifests never fully validated against tarball contents
• Assumption of consistency between manifest and tarball
• Vulnerability to exploitation:
  • Tools using public registry susceptible
  • Bad actors can hide malware in dependencies
  • Transitive dependencies can introduce malware undetected
• Supply chain attack risk through version bumping of dependencies

Comparison and Market Dynamics

JSR vs Vault Approaches

• JSR: Transparent development, specific feature announcements, whitelist beta
• Vault: Stealth mode, minimal public information, focus on team/funding announcements
• Similar to early NPM/Node disagreements (Ryan Dahl's resistance to package.json, dependency locking)

Current Package Publishing Challenges

• Publishing packages significantly harder than necessary
• Need for quick code publishing and global distribution
• Anticipation for ecosystem change after years of stagnation