NewsLab
Apr 29 02:54 UTC

NPM website was down (status.npmjs.org)

125 points|by 18nleung||61 comments|Read full story on status.npmjs.org

Comments (61)

61 shown
  1. 1. normie3000||context
    Well it is owned by github.
  2. 2. cute_boi||context
    which is owned by microslop
  3. 3. rvz||context
    ...and proudly maintained by Microsoft's AI agents: Tay.ai, Zo, and Copilot.

    They seem to be doing a pretty good job at wrecking both GitHub and npm at the same time.

  4. 4. adxl||context
    Clippy was too stupid to qualify as an AI.
  5. 5. saadn92||context
    ha, github is down too
  6. 6. xmprt||context
    With all the github instability, I wonder if Cloudflare or some other provider is going to look into providing a similar service.
  7. 7. sofixa||context
    GitLab is right there. And overall provides a better product than GitHub, if nothing else on these two points:

    * You can actually have an organisational structure (folders/namespaces), and projects can be moved around with automatic redirects. Also, inheritance of access controls, variables between the namespaces

    * GitLabCI is organised in a way that makes supply chain attacks less of a risk. GitHub Actions takes the NPM/JS approach, where every step is an action, one you usually need to get off someone, with shoddy versioning, tons of transient dependencies, etc. In GitLabCI you can have templates, but you don't have to use an external template for every bit. It's shell scripting on top of containers, so you can have custom container images with your stuff, or custom scripts, or templates that bundle it all.

  8. 8. fontain||context
    All of those features are supported by GitHub in some form, e.g: Organizations can now belong to Enterprises.
  9. 9. dijksterhuis||context
    tree based directory structure stuff is available on gitlab’s free tier — so are all the permissions inheritance for groups etc.

    so, while you’re technically right, these features are apparently paywalled heavily on github.

    ime you get more features on gitlab for the same price (or less). i switched fully two years ago and im not going back.

  10. 10. sofixa||context
    It's not the same, at all.

    SSO, access tokens, secrets are all bound to the Organization level - if you work on multiple Organizations you have to log in separately... You also cannot have nested Organizations.

  11. 11. justinclift||context
    GitLab also limits the size of PRs/MRs, which makes it Unfit for Purpose. :( :( :(

    Its a problem they know about, but have no plan to fix before 2027.

  12. 12. irishcoffee||context
    I mean, the PR limit is like a million characters. I would also reject a PR of a million characters. That’s bananas.
  13. 13. justinclift||context
    Not sure about that "million characters", but we've been bitten by it in our production systems. :(

    Thus, we're moving off GitLab.

  14. 14. irishcoffee||context
    I'm sure, I looked it up.
  15. 15. skullone||context
    What use case does a million character PR have?
  16. 16. justinclift||context
    When an automated system creates a PR for merging from an existing dev branch (that's been extensively tested) to "master" (or "main").

    The "surprise, you can't review all the files in your PR" using GitLabs standard web based tooling makes it a no-go.

  17. 17. sofixa||context
    That's interesting because GitHub's web UI craps out at much less than 1 million lines. It refuses to open even low thousand line diffs.
  18. 18. justinclift||context
    Yeah, agreed it's not great for that. I'm not real happy with GitHub's worsening UX either, but it'll at least show the _names_ of all the files in the PR.

    With GitLab, when you hit the rate limit, any file "past" that limit doesn't even show that it exists in the MR. It just looks like the MR is missing a bunch of stuff, with no workaround available. :( :( :(

  19. 19. xp84||context
    I’ve personally been deeply unappreciated of Github’s changes in the last few years to automatically not show diffs to “large files” without having to click to open them - which seems to be a threshold that continues to shrink. Maybe like 3 screenfuls of content is the limit now per file. It’s crazy.
  20. 20. dllrr||context
    Cloudflare artifacts??

    https://developers.cloudflare.com/artifacts/

  21. 21. xmprt||context
    I mean more like a full git competitor. Gitlab exists but more competition is generally better for the consumer and it looks like Github's lead is starting to falter with all these incidents.
  22. 22. corvad||context
    I wonder if this is an underlying infra issue with Azure being that Github was also having issues.
  23. 23. 2ndorderthought||context
    I bet 10 dollars it's DNS.
  24. 24. corvad||context
    Just wait and it will be something like "Github's internal DNS was down and caused widespread service communication issues."
  25. 25. Scipio_Afri||context
    Easy there buddy, not everything needs to be a polymarket bet :-)
  26. 26. Imustaskforhelp||context
    I am waiting for jeff geerling's "its always dns" t-shirt reference/video about it if that's the case.
  27. 27. thanatos_dem||context
    Nah, can't be, Azure DNS has a 100% SLA after all: https://learn.microsoft.com/en-us/azure/dns/dns-faq#what-is-...
  28. 28. shakna||context
    "Always" up, but maybe not going where you expect. [0]

    [0] https://arstechnica.com/information-technology/2026/01/odd-a...

  29. 29. parliament32||context
    To be fair, it feels like the DNS service has been the most reliable part of our Azure infra. Never really had issues with it, whether with traffic or API calls.
  30. 30. yomismoaqui||context

      It's not DNS
  There's no way it's DNS
  It was DNS
    - SSBroski
  31. 31. basilikum||context
    It's DNS

    If it's not DNS it's MTU if you're a person and BGP if you're a company.

  32. 32. xaxfixho||context
    it might just be *AZURE*
  33. 33. munk-a||context
    It's likely someone just ran npm ls -all
  34. 34. nulltrace||context
    We added a preflight curl against registry.npmjs.org before the install step in CI. Not surprising they went down together.
  35. 35. cozzyd||context
    That's one way to fix supply chain vulnerabilities.
  36. 36. tantalor||context
    Can't have any vulnerabilities if you don't have a supply chain
  37. 37. nine_k||context
    More seriously, keeping a local cache of external npm packages, and a local artifact storage for internal npm packages looks like a wise thing to have done long ago. Might be cheaper in the long run.

    Ironically, both Nandu and Verdaccio are implemented in Tyepscript and install via npm.

    (Same logic obviously applies to Python packages, Docker images, etc.)

  38. 38. XorNot||context
    Caching NPM was easier when you could pull the Couchbase replicate API. Afaik that's gone and now you just have to send a bazillion http requests instead.
  39. 39. nine_k||context
    Sending a bazillion http requests within your LAN, or at least your VPC, is much easier, faster, and cheaper.

    Both yarn and pnpm support http/2 which speeds up the bazillion requests quite a bit.

  40. 40. miohtama||context
    Only if we had a turn key distributed cache, like IPFS
  41. 41. cluckindan||context
    Waiting for the BitTorrent package manager
  42. 42. ibejoeb||context
    Does IPFS support content eviction now? If not, that could go wrong really fast. You get a compromised package out there and then, I think, literally every node needs to unpin it or it remains.
  43. 43. zadikian||context
    Presumably, how ever you mark a version as latest would also be how you mark one as compromised. IPFS files are immutable and keyed by hash. But this seems like overengineering.
  44. 44. hmokiguess||context
    At my former job we had a private registry that was a mirror of npm’s with an approval gate for packages devs would request and it would always pin versions

    I took that for granted back then and just assumed it was standard enterprise policy

  45. 45. jamesfinlayson||context
    Multiple previous jobs had this too (local Packagist is thing, Artifactory is another) but my current job got rid of theirs. Seemed a little short-sighted given the risks but I don't make the decisions.
  46. 46. spartanatreyu||context
    > a local artifact storage for internal npm packages looks like a wise thing to have done long ago

    Deno already does this invisibly by default.

    All packages are stored in the global cache.

    No need to store multiple versions of the same dependencies across projects.

    To the code in your projects: there is no such thing as a global cache. Just import your dependencies like normal and deno maps them to the global cache.

  47. 47. airstrike||context
    https://www.ebay.com/ is also down
  48. 48. Raed667||context
    lots of amazon pages & search seem to be degraded as well
  49. 49. cute_boi||context
    microslop slops are down.
  50. 50. 12345hn6789||context
    Azure is completely dead across multiple resources. Confirming....
  51. 51. DaiPlusPlus||context
    https://azure.status.microsoft/en-US/status says "There are currently no active events." - and everything's fine with my day-job's Azure sub right now.
  52. 52. simjnd||context
    https://npmx.dev is not
  53. 53. naikrovek||context
    Oh no. At least nothing of value is affected.

    :)

  54. 54. idoxer||context
    Works for me, could be region related
  55. 55. corvad||context
    Fixed as of 22:30 UTC. Hope there's a postmortem.
  56. 56. squarefoot||context
    Ebay is also down. https://www.isitdownrightnow.com/ebay.com.html
  57. 57. dabinat||context
    Tailscale too: https://status.tailscale.com/
  58. 58. hexasquid||context
    Hold the jokes until we're sure this isn't an `.unwrap()`
  59. 59. iLemming||context
    First GitHub, now NPM? Oh no... That is happening, guys. Rise of the machines. I hope Jira is next and Slack follows.
  60. 60. dmitrygr||context
    libc is still working just fine, as is the linux kernel. Mayhaps having 2000 dependencies on 3000 packages from 4000 unvetted sources was a mistake afterall?
  61. 61. lrvick||context
    Whenever NPM is offline, the internet is a little safer.

    Keep up the good work Microsoft.

    Let's shoot for 100% downtime though. Thanks.