{"rid":"storage/npm-public-registry","card":{"rid":"storage/npm-public-registry","eid":"npmjs","topic":"storage","slug":"npm-public-registry","provider":"npm public registry (registry.npmjs.org)","url":"https://www.npmjs.com","domain":"npmjs.com","category":"registry","tier":null,"verdict":"qualifies","vorder":0,"grp":"usable","confidence":"reported","binding":"none","identity_kind":"email","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"rest,rclone,cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-21T00:00:00.000Z","verified_basis":"inherited","checked_on":"2026-10-21","stale_on":"2026-11-04","n_evidence":9,"usd_month":null,"usd_per_tb_month":null,"summary":"No total storage quota, no per-account package cap ('Unlimited public packages' — npm Pro page), no cap on versions per package. The only bounds are per-arte...","duplicate_of":null,"n_unknown":5},"record":{"topic":"storage","slug":"npm-public-registry","provider":"npm public registry (registry.npmjs.org)","url":"https://www.npmjs.com","category":"registry","free_tier":{"stated":"No total storage quota, no per-account package cap ('Unlimited public packages' — npm Pro page), no cap on versions per package. The only bounds are per-artefact and per-packument: empirically ~200 MB per tarball (no documented figure anywhere) and 100 MB per *packument* (the accumulated metadata document for all versions of one package).","unit":"unlimited","metered_on":"stored-bytes","source_url":"https://www.npmjs.com/products/pro","read_on":"2026-10-21","notes":null},"per_object_cap":{"stated":"not stated","source_url":"https://www.npmjs.com/products/pro","notes":"not stated"},"retention":{"stated":"| Append-only and durable — 2018 tarballs still serve with the original Last-Modified","source_url":"https://www.npmjs.com/products/pro","notes":"not stated"},"egress":{"terms":"Free and unmetered, Cloudflare-fronted. Probe: GET of a 70 MB tarball returned Server: cloudflare, Cache-Control: 'public, immutable, max-age=31557600', Accept-Ranges: bytes; ranged GET returned 206 Partial Content. No auth, no signed URL, no expiry.","metered":false},"interface":["rest","rclone","cli"],"interface_detail":"rest","tooling":"Two-verb REST: PUT /:pkg with a JSON body containing base64 _attachments (or the standard npm publish flow), GET /:pkg/-/:pkg-:ver.tgz for the blob. Named clients: npm CLI, libnpmpublish (github.com/npm/libnpmpublish), and purpose-built chunking wrappers — gist github.com/yulioaj290/e81d3a59ec00247f00ec34db378fae6c (shell script that splits a file into N MB chunks, publishes each as its own npm package, adds the rest as dependencies of chunk 1, and emits an unzip script), indexzero/npm-publish-split-stream (4 stars, streams a publish request without buffering). No rclone backend.","chaining":"UNBOUNDED: unlimited packages per account (Pro page: 'Unlimited public packages') x unlimited versions per package (bounded only by the 100 MB packument, ~763 versions for a 131 KB manifest — so keep manifests tiny and use many packages, not many versions of one package) x ~200 MB per tarball. 10 TiB hot = ~52,000 x 200 MB tarballs. Free accounts are per-email and per-GitHub-identity, so identities multiply the publish-rate ceiling, not the space ceiling.","limits":[],"limits_note":"~200 MB per tarball (413 Payload Too Large above that: one reporter hits it at 200 MB, pretendard's 229.9 MB tarball was rejected with E413; a 70 MB tarball serves fine). 100 MB per packument before compression — this is a *version-count* cap, not a byte cap. Publish is rate limited (429s reported in CI, github.com/npm/cli/issues/8507); exact rate not published. Versions are immutable and cannot be deleted after 72h unless the package has <300 weekly downloads and a single maintainer (unpublish policy). An unpublish frees the name's version slot only for new versions, never reuses a version string.","identity_cost":{"kind":"email","detail":"derived from the record's prose, not from an identity field, and no signup was executed: TiB hot = ~52,000 x 200 MB tarballs. Free accounts are per-email and per-GitHub-identity, so identities multiply the publish-rate ceiling, not the space ceiling. ~200 MB per tarball (4","country":null},"reliability_note":"Append-only and durable — 2018 tarballs still serve with the original Last-Modified. Two hard failure modes for a bulk workload: silent 413 at ~200 MB (undocumented, so budget 150 MB), and packument bloat refusing all new versions for the whole package once it crosses 100 MB. Automated mass publishing gets 429'd.","confidence":"reported","confidence_note":"One page read moves it to documented.","evidence":[{"url":"https://www.npmjs.com/products/pro","date":"2026-10-21","proved":"'Unlimited public packages'"},{"url":"https://www.vlt.io/blog/packument-size-limits","date":"2026-10-21","proved":"the 100 MB packument limit explained with the Drizzle ORM outage (June 2026); 'the NPM registry will simply refuse any new versions from being published'"},{"url":"https://github.com/npm/documentation/issues/1691","date":"2026-10-21","proved":"'once my package goes above 200MB I receive this error ... 413 Payload Too Large - PUT https://registry.npmjs.org/'"},{"url":"https://github.com/npm/cli/issues/4794","date":"2026-10-21","proved":"pretendard 229.9 MB tarball -> npm ERR! code E413"},{"url":"https://docs.npmjs.com/policies/unpublish/","date":"2026-10-21","proved":"72h / <300 downloads / single-owner deletion rules; 'Registry data is immutable'"},{"url":"https://registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.20.1.tgz","date":"2026-10-21","proved":"probe: HEAD -> 200, Content-Length: 70026530, Cache-Control: public, immutable, max-age=31557600, Server: cloudflare"},{"url":null,"date":"2026-10-21","proved":"probe: GET same URL with Range: bytes=0-1023 -> 206 Partial Content, Content-Range: bytes 0-1023/70026530"},{"url":"https://registry.npmjs.org/@types/node","date":"2026-10-21","proved":"probe: GET -> 200, Content-Length: 11180437 (packument already 11 MB, i.e. 11% of the 100 MB ceiling, for a metadata-only package)"},{"url":"https://registry.npmjs.org/kimi-probe-abc-123","date":"2026-10-21","proved":"probe: anonymous PUT -> 404 Not Found, i.e. publishing requires a token (no anonymous writes)"}],"verdict":"qualifies","verified_at":"2026-10-21T00:00:00.000Z","notes":"No total storage quota, no per-account package cap ('Unlimited public packages' — npm Pro page), no cap on versions per package. The only bounds are per-artefact and per-packument: empirically ~200 MB per tarball (no documented figure anywhere) and 100 MB per *packument* (the accumulated metadata document for all versions of one package).","extras":{},"binding":"none","binding_note":"no constraint in the record binds at this scale; the record carries no limit of a kind the vocabulary names"},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":200,"unit":"MB","per":null,"currency":null,"usd":null,"fx_date":null,"parse":"ok"}],"unknown":[["$.evidence[6].url","private-url"],["$.free_tier.notes","process"],["$.per_object_cap.notes","not-extracted"],["$.per_object_cap.stated","not-extracted"],["$.retention.notes","not-extracted"]],"history":[],"drift":[]}