npm public registry

npmjs.com · Storage · 1 record · JSON

npm public registry (registry.npmjs.org) Storage

★ qualifiesemailno cardR

www.npmjs.com · registry · storage/npm-public-registry · JSON · compare

Free tier	No total storage quota, no per-account package cap ('Unlimited public packages' — npm Pro page), no cap on versions per package. The only bounds are per-artefact and per-packument: empirically ~200 MB per tarball (no documented figure anywhere) and 100 MB per packument (the accumulated metadata document for all versions of one package). unit unlimited; metered on stored-bytes
Price	none stated
Per-object cap	not stated
Retention	\| Append-only and durable — 2018 tarballs still serve with the original Last-Modified
Egress	Free and unmetered, Cloudflare-fronted. Probe: GET of a 70 MB tarball returned Server: cloudflare, Cache-Control: 'public, immutable, max-age=31557600', Accept-Ranges: bytes; ranged GET returned 206 Partial Content. No auth, no signed URL, no expiry.
Identity	email derived from the record's prose, not from an identity field, and no signup was executed: TiB hot = ~52,000 x 200 MB tarballs. Free accounts are per-email and per-GitHub-identity, so identities multiply the publish-rate ceiling, not the space ceiling. ~200 MB per tarball (4
Binding	none no constraint in the record binds at this scale; the record carries no limit of a kind the vocabulary names
Interface	rest, rclone, cli rest
Tooling	Two-verb REST: PUT /:pkg with a JSON body containing base64 _attachments (or the standard npm publish flow), GET /:pkg/-/:pkg-:ver.tgz for the blob. Named clients: npm CLI, libnpmpublish (github.com/npm/libnpmpublish), and purpose-built chunking wrappers — gist github.com/yulioaj290/e81d3a59ec00247f00ec34db378fae6c (shell script that splits a file into N MB chunks, publishes each as its own npm package, adds the rest as dependencies of chunk 1, and emits an unzip script), indexzero/npm-publish-split-stream (4 stars, streams a publish request without buffering). No rclone backend.
Composes with	UNBOUNDED: unlimited packages per account (Pro page: 'Unlimited public packages') x unlimited versions per package (bounded only by the 100 MB packument, ~763 versions for a 131 KB manifest — so keep manifests tiny and use many packages, not many versions of one package) x ~200 MB per tarball. 10 TiB hot = ~52,000 x 200 MB tarballs. Free accounts are per-email and per-GitHub-identity, so identities multiply the publish-rate ceiling, not the space ceiling.
Reliability	Append-only and durable — 2018 tarballs still serve with the original Last-Modified. Two hard failure modes for a bulk workload: silent 413 at ~200 MB (undocumented, so budget 150 MB), and packument bloat refusing all new versions for the whole package once it crosses 100 MB. Automated mass publishing gets 429'd.
Notes	No total storage quota, no per-account package cap ('Unlimited public packages' — npm Pro page), no cap on versions per package. The only bounds are per-artefact and per-packument: empirically ~200 MB per tarball (no documented figure anywhere) and 100 MB per packument (the accumulated metadata document for all versions of one package).
Evidence rung	reported One page read moves it to documented.
Checked	2026-10-21 (inherited); stale on 2026-11-04

Evidence (9)

date	source	what it proved
2026-10-21	www.npmjs.com/products/pro	'Unlimited public packages'
2026-10-21	www.vlt.io/blog/packument-size-limits	the 100 MB packument limit explained with the Drizzle ORM outage (June 2026); 'the NPM registry will simply refuse any new versions from being published'
2026-10-21	github.com/npm/documentation/issues/1691	'once my package goes above 200MB I receive this error ... 413 Payload Too Large - PUT https://registry.npmjs.org/'
2026-10-21	github.com/npm/cli/issues/4794	pretendard 229.9 MB tarball -> npm ERR! code E413
2026-10-21	docs.npmjs.com/policies/unpublish/	72h / <300 downloads / single-owner deletion rules; 'Registry data is immutable'
2026-10-21	registry.npmjs.org/onnxruntime-node/-/onnxruntime-node-1.20.	probe: HEAD -> 200, Content-Length: 70026530, Cache-Control: public, immutable, max-age=31557600, Server: cloudflare
2026-10-21	withheld	probe: GET same URL with Range: bytes=0-1023 -> 206 Partial Content, Content-Range: bytes 0-1023/70026530
2026-10-21	registry.npmjs.org/@types/node	probe: GET -> 200, Content-Length: 11180437 (packument already 11 MB, i.e. 11% of the 100 MB ceiling, for a metadata-only package)
2026-10-21	registry.npmjs.org/kimi-probe-abc-123	probe: anonymous PUT -> 404 Not Found, i.e. publishing requires a token (no anonymous writes)

Unknown or withheld values (5)

$.evidence[6].url private-url
$.free_tier.notes process
$.per_object_cap.notes not-extracted
$.per_object_cap.stated not-extracted
$.retention.notes not-extracted

Built from commit 872967ae41, data as of 2026-10-27. Every value links to its source; freshness badges are computed in your browser. How to read this.