Skip to content

Instantly share code, notes, and snippets.

@zeke

zeke/npm-2026.md

Created June 29, 2026 20:08
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save zeke/c62d6d5a0424208f972f0fd20ddd698e to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save zeke/c62d6d5a0424208f972f0fd20ddd698e to your computer and use it in GitHub Desktop.
Download ZIP
Who's Working on npm in 2026
Raw
npm-2026.md

Who's Working on npm in 2026

npm started as a scrappy indie company (npm, Inc., founded 2014), got acquired by GitHub in March 2020, and is now a Microsoft product. Almost none of the original crew stuck around. Here's who's actually working on it now, and where the old guard ended up.

Current CLI Team

These are the people with meaningful commits to npm/cli in 2025-2026:

Person GitHub Role What they're doing
Michael Smith @owlstronaut GitHub Staff Releases, infra, dep maintenance. Effectively the team lead.
Jamie Magee @JamieMagee Principal Engineer Owns the npm 12 security overhaul: default-deny install scripts, allowScripts opt-in. Also in @ossf and @dependabot orgs.
Manzoor Wani @manzoorwanijk External contributor Most prolific committer right now. Driving the new linked install strategy (pnpm-style). Automattic affiliation.
Gregory Cosmo @reggi Collaborator Listed as npm package maintainer on the registry. Recent commits on user-agent improvements.
Saquib Khan @saquibkhan Collaborator Listed as npm package maintainer on the registry.

npm Org Public Members (Registry/Platform Side)

Only 5 people have public membership in the @npm GitHub org. These folks appear to be on the registry and platform side rather than the CLI:

GitHub Notes
@steiza Zach Steindler. Security-focused, in @ossf and @sigstore.
@jeffwidman Also in @dependabot and @primer orgs.
@jurre Works on @dependabot. Based in the Netherlands.
@xodene Also in @primer.
@dhei Di Hei. Registry services, former Azure engineer.

The org has many more members with private membership. This is just who chose to make it public.

Where the Old Guard Went

The original npm, Inc. team is long gone. Here's where the key people ended up:

Person GitHub npm Era Now
Isaac Schlueter @isaacs Creator of npm, founder/CEO Independent OSS. Maintaining tap, glob, rimraf, lru-cache.
Laurie Voss @seldo Co-founder, COO Arize AI (ML observability).
Rebecca Turner @iarna npm v5/v6 architect Independent. Still active in TC39 and Node.js.
Darcy Clarke @darcyclarke CLI lead (post-acquisition era) Departed GitHub.
Ruy Adorno @ruyadorno Core CLI team Departed GitHub.
Myles Borins @MylesBorins Post-acquisition contributor Now at Snowflake.
Nathan Friedly @nlf Pre-acquisition engineer Now at Code4rena.
Aria Stewart @aredridel Early registry/tooling engineer Freelancing.

What They're Building: npm 12

The current team is deep in npm 12, which has two main themes:

  • Linked install strategy: a pnpm-style symlink-based install mode, mostly driven by @manzoorwanijk. Represents a significant shift in how npm handles node_modules.
  • Default-deny install scripts: opt-in allowScripts config so packages can't run arbitrary postinstall scripts without explicit approval. @JamieMagee's project, clearly influenced by supply chain security priorities at GitHub/Microsoft.

Sources

Research conducted on June 29, 2026 via automated research (AI-assisted). Primary sources:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment