How npm is regulated? Anybody can publish their package on npm as they can do on GitHub. There is no up-front review on npm. Only packages that are clearly harmful to the community are removed from npm.