Hacker News Reader

> If that is the case, then contributor's emails are being 'leaked' without their say-so or probably knowledge

When you login into the NPM CLI it printed in all caps that the given email address will be public.

I don't like this either about NPM, but it's not like they are leaking in, they are upfront about it and warn you that the registered email address will be accessible to anyone in the package metadata.

View on HN

Yes, that is totally true. That's kinda what I was going for putting 'leaked' in quotes. It's not really leaked because the data is technically public. You can of course scrape it from say: https://registry.npmjs.org/react

However, it's been made significantly more accessible in a tool like this. NPM doesn't list it prominently in their UI anywhere (I believe).

So the 'leak' is up-publicizing data outside of the control of the owner, and when other, intentional (and likely better) alternatives exist.

Reply on news.ycombinator.com