Skip to content

Commit 89de7b8

Browse files
demiraclt-dekellMylesBorinsDeina Kellezi
authored
Added policy pages (#20)
* added policy pages * updated links refering to policy pages * added 2 missing policy pages * clean up PR * format policy index page as npmjs.com * fixed policy urls to full path * updated the git history urls for policy pages * Update content/policies/index.mdx Co-authored-by: Myles Borins <mylesborins@github.com> * Removed receiving reports * Fix link * Fix link * Fix other link * Update Co-authored-by: t-dekell <59473246+t-dekell@users.noreply.github.com> Co-authored-by: Myles Borins <mylesborins@github.com> Co-authored-by: Deina Kellezi <t-dekell@github.com>
1 parent 203783d commit 89de7b8

22 files changed

+3230
-7
lines changed

‎content/packages-and-modules/updating-and-managing-your-published-packages/transferring-a-package-from-a-user-account-to-another-user-account.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,5 +45,5 @@ npm owner add <their-username> <package-name> --otp=123456
4545
npm owner rm <your-username> <package-name> --otp=123456
4646
```
4747

48-
[dispute-policy]: https://www.npmjs.com/policies/disputes
48+
[dispute-policy]: /policies/disputes
4949
[npm-owner]: cli/owner

‎content/packages-and-modules/updating-and-managing-your-published-packages/unpublishing-packages-from-the-registry.mdx‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import shared from '../../../src/shared.js'
55

66
## How to unpublish
77

8-
As a package owner or collaborator, if your package has no dependents, you can permanently remove it from the npm registry by using the CLI. You can [unpublish][unpublish-cli] within 72 hours of the initial publish. Beyond 72 hours,so you can still unpublish your package if [it meets certain criteria](https://www.npmjs.com/policies/unpublish).
8+
As a package owner or collaborator, if your package has no dependents, you can permanently remove it from the npm registry by using the CLI. You can [unpublish](https://docs.npmjs.com/cli/v7/commands/npm-unpublish) within 72 hours of the initial publish. Beyond 72 hours, you can still unpublish your package if [it meets certain criteria](https://www.npmjs.com/policies/unpublish).
99

1010
<Note>
1111

@@ -37,7 +37,7 @@ If you have [two-factor authentication][two-factor-auth] enabled for writes, you
3737

3838
**Note:** If you unpublish an entire package, you may not publish any new versions of that package until 24 hours have passed.
3939

40-
</Note>
40+
</Note>
4141

4242
## When to unpublish
4343

@@ -61,9 +61,8 @@ You might want to unpublish a package because you:
6161
If you are no longer interested in maintaining a package, but want it to remain available for users to install, or if your package has dependents, we'd recommend [deprecating][deprecate-cli] it. To learn about how to deprecate a package, see "[Deprecating and undeprecating packages or package versions][deprecate-package]".
6262

6363

64-
[unpublish-cli]: cli/unpublish
6564
[oh-no]: https://blog.npmjs.org/post/101934969510/oh-no-i-accidentally-published-private-data-to
6665
[deprecate-cli]: cli/deprecate
6766
[deprecate-package]: deprecating-and-undeprecating-packages-or-package-versions
68-
[unpublish-policy]: https://www.npmjs.com/policies/unpublish
6967
[two-factor-auth]: about-two-factor-authentication
68+
[unpublish]: /policies/unpublish

‎content/policies/business-solution-terms.mdx‎

Lines changed: 523 additions & 0 deletions
Large diffs are not rendered by default.

‎content/policies/conduct.mdx‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
---
2+
title: npm Code of Conduct
3+
---
4+
npm exists to facilitate sharing code, by making it easy for
5+
JavaScript module developers to publish and distribute packages.
6+
7+
npm is a piece of technology, but more importantly, it is a community.
8+
9+
We believe that our mission is best served in an environment that is
10+
friendly, safe, and accepting; free from intimidation or harassment.
11+
12+
Towards this end, certain behaviors and practices will not be
13+
tolerated.
14+
15+
## tl;dr
16+
17+
* Be respectful.
18+
* We're here to help
19+
* Abusive behavior is never tolerated.
20+
* Data published to npm is hosted at the discretion of the service
21+
administrators, and may be removed.
22+
* Violations of this code may result in swift and permanent expulsion
23+
from the npm community.
24+
25+
## Scope
26+
27+
We expect all members of the npm community, including paid and unpaid
28+
agents, administrators, users, and customers of npm, Inc., to abide by
29+
this Code of Conduct at all times in all npm community venues, online
30+
and in person, and in one-on-one communications pertaining to npm
31+
affairs.
32+
33+
This policy covers the usage of the npm registry, as well as the npm
34+
website, npm related events, and any other services offered by or on
35+
behalf of npm, Inc. (collectively, the "Service"). It also applies to
36+
behavior in the context of the npm Open Source project communities,
37+
including but not limited to public GitHub repositories, IRC channels,
38+
social media, mailing lists, and public events.
39+
40+
This Code of Conduct is in addition to, and does not in any way
41+
nullify or invalidate, any other terms or conditions related to use of
42+
the Service.
43+
44+
The definitions of various subjective terms such as "discriminatory",
45+
"hateful", or "confusing" will be decided at the sole discretion of
46+
the npm abuse team.
47+
48+
## Friendly Harassment-Free Space
49+
50+
We are committed to providing a friendly, safe and welcoming
51+
environment for all, regardless of gender identity, sexual
52+
orientation, ability, ethnicity, religion, age, physical
53+
appearance, body size, race, or similar personal characteristics.
54+
55+
We ask that you please respect that people have differences of opinion
56+
regarding technical choices, and that every design or implementation
57+
choice carries a trade-off and numerous costs. There is seldom a
58+
single right answer. A difference of technology preferences is not a
59+
license to be rude.
60+
61+
Disputes over package rights must be handled respectfully, according
62+
to the terms described in the [Disputes Policy][disputes].
63+
There is never a good reason to be rude over package name disputes.
64+
65+
Any spamming, trolling, flaming, baiting, or other attention-stealing
66+
behavior is not welcome, and will not be tolerated.
67+
68+
Harassing other users of the Service is never tolerated, whether via
69+
public or private media.
70+
71+
Avoid using offensive or harassing package names, nicknames, or other
72+
identifiers that might detract from a friendly, safe, and welcoming
73+
environment for all.
74+
75+
Harassment includes, but is not limited to: harmful or prejudicial
76+
verbal or written comments related to gender identity, sexual
77+
orientation, ability, ethnicity, religion, age, physical
78+
appearance, body size, race, or similar personal characteristics;
79+
inappropriate use of nudity, sexual images, and/or sexually explicit
80+
language in public spaces; threats of physical or non-physical harm;
81+
deliberate intimidation, stalking or following; harassing photography
82+
or recording; sustained disruption of talks or other events;
83+
inappropriate physical contact; and unwelcome sexual attention.
84+
85+
## Acceptable Use
86+
87+
The Service administrators reserve the right to make judgment calls
88+
about what is and isn't appropriate in published packages, package names,
89+
user and organization names, and other public content. Package that
90+
violates the npm Service's
91+
[Acceptable Use][acceptable-use]
92+
rules including its
93+
[Acceptable Content][acceptable-content]
94+
rules will be deleted, at the discretion of npm.
95+
96+
## Reporting Violations of this Code of Conduct
97+
98+
Please select the method of contact you think is most appropriate for
99+
the form of violation:
100+
101+
* For urgent security issues, please open a ticket at <https://npmjs.com/support>.
102+
Requests to un-publish packages are not usually considered urgent security
103+
issues, as it is possible to [un-publish a package][unpublish]
104+
within 24 hours of its first publish. Any publicly published package
105+
is [immediately replicated to thousands of third-party mirrors](http://blog.npmjs.org/post/101934969510/oh-no-i-accidentally-published-private-data-to),
106+
so any confidential information contained in a package should be considered
107+
immediately compromised.
108+
109+
* If you believe someone is harassing you or is demonstrating
110+
some other form of malicious or inappropriate behavior, open a support
111+
ticket at https://npmjs.com/support. If this is the initial report of a problem,
112+
please include as much detail as possible. It is easiest for us
113+
to address issues when we have more context.
114+
115+
* If you have concerns about a potential copyright violation,
116+
please refer to our [Copyright Policy][dmca]
117+
and take action as recommended by that policy.
118+
119+
* If you think a package or other content is "squatting" on a name,
120+
follow the process described in the
121+
[Disputes Policy][disputes].
122+
123+
For any other issues, or if in doubt, [contact support](https://npmjs.com/support).
124+
125+
126+
## Consequences
127+
128+
All content published to the Service, including user account
129+
credentials, is hosted at the sole discretion of the npm
130+
administrators.
131+
132+
Unacceptable behavior from any community member, including sponsors,
133+
employees, customers, or others with decision-making authority, will
134+
not be tolerated.
135+
136+
Anyone asked to stop unacceptable behavior is expected to comply
137+
immediately.
138+
139+
If a community member engages in unacceptable behavior, the npm
140+
administrators may take any action they deem appropriate, up to and
141+
including a temporary ban or permanent expulsion from the community
142+
without warning (and without refund in the case of a paid event or
143+
service).
144+
145+
## Addressing Grievances
146+
147+
If you feel you have been falsely or unfairly accused of violating
148+
this Code of Conduct, you should notify npm, Inc. We will do our best
149+
to ensure that your grievance is handled appropriately.
150+
151+
In general, we will choose the course of action that we judge as being
152+
most in the interest of fostering a safe and friendly community.
153+
154+
## Contact Info
155+
156+
Please open a support ticket at <https://npmjs.com/support> if you need to
157+
report a problem or address a grievance related to an abuse report.
158+
159+
You are also encouraged to contact us if you are curious about
160+
something that might be "on the line" between appropriate and
161+
inappropriate content. We are happy to provide guidance to help you
162+
be a successful part of our community.
163+
164+
## Changes
165+
166+
This is a living document and may be updated from time to time.
167+
Please refer to the [git history for this
168+
document](https://github.com/npm/documentation/blob/main/content/policies/conduct.mdx)
169+
to view the changes.
170+
171+
## Credit and License
172+
173+
This Code of Conduct borrows heavily from the Stumptown Syndicate
174+
[Citizen's Code of Conduct](http://citizencodeofconduct.org/), and the
175+
[Rust Project Code of
176+
Conduct](https://www.rust-lang.org/conduct.html).
177+
178+
This document may be reused under a [Creative Commons
179+
Attribution-ShareAlike
180+
License](https://creativecommons.org/licenses/by-sa/4.0/).
181+
182+
[disputes]: /policies/disputes
183+
[acceptable-use]: /policies/open-source-terms#acceptable-use
184+
[acceptable-content]: /policies/open-source-terms#acceptable-content
185+
[unpublish]: /policies/unpublish
186+
[dmca]: /policies/dmca

‎content/policies/crawlers.mdx‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
title: Crawler policy
3+
---
4+
5+
npm's full public dataset is available via the [public registry](https://docs.npmjs.com/misc/registry). Using CouchDB replication, you can get a full copy of all metadata, and it is acceptable within our terms of use to download copies of tarballs for inspection or experimentation.
6+
7+
npm's [website](https://www.npmjs.com) also has package metadata available. We allow this content to be indexed by commercial crawlers such as GoogleBot. At our discretion, we also allow experimental crawlers to access the site, as long as they keep their request velocity to 1 request per second or less. At that velocity, indexing all packages would take 3 days, so if you want a full copy of our metadata it is always going to be faster to access the data via replication, which takes only an hour or two to provide full data and will thereafter automatically stay in sync.
8+
9+
If you do not wish to install CouchDB to manage replication, we provide [open source software](https://github.com/npm/concurrent-couch-follower) that makes it easy to sync to the registry's public feed.
10+
11+
If you attempt to access package metadata by high-velocity crawling of the npm website, we reserve the right to rate-limit or ban your IP, user-agent or both.

‎content/policies/disputes.mdx‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
title: Dispute Resolution
3+
---
4+
5+
This document describes the steps that you should take to resolve module
6+
name disputes with other npm publishers. It also describes special steps
7+
you should take about names you think [infringe your trademarks](#trademarks).
8+
9+
This document is additive to the guidelines in the
10+
[npm Code of Conduct][conduct] and
11+
[npm Open-Source terms][open-source-terms].
12+
Nothing in this document should be interpreted to contradict any aspect
13+
of the npm Code of Conduct or Open-Source Terms.
14+
15+
## tl;dr
16+
17+
1. Open a support ticket at <https://npmjs.com/support>
18+
1. Explain why you require a package, org, or username transferred
19+
1. Support will address your request. Please note submitting a report does not
20+
guarantee the transfer of a package, org, or username.
21+
22+
## When to use this process
23+
24+
This process is an excellent way to:
25+
26+
* Adopt a package created from your project, published by someone else
27+
* Report a deliberately misleading or confusing package name
28+
29+
This process does not apply if the package violates our
30+
[Terms of Use][open-source-terms],
31+
in particular our
32+
[Acceptable Use][acceptable-use]
33+
and [Acceptable Content][acceptable-content]
34+
rules, or our [Code of Conduct][conduct].
35+
Those documents refer to this one to resolve cases of "squatting"; see
36+
below.
37+
38+
If you see bad behavior or content you believe is unacceptable, refer to
39+
the Code of Conduct for guidelines on
40+
[reporting violations][violations].
41+
**You are never expected to resolve abusive behavior on your own.**
42+
**We are here to help.**
43+
44+
## When not to use this process
45+
46+
We are not currently accepting dispute requests to "adopt an abandoned
47+
package" or "Report Squatting" as we re-evaluate and update the overall
48+
dispute process.
49+
50+
## Beginning the process
51+
52+
### Packages
53+
54+
To dispute a package called `foo`, follow these steps:
55+
56+
1. Open a support ticket at <https://npmjs.com/support>, indicating that
57+
you would like to start the process to request ownership of the `foo`
58+
package. Please explain the why you believe the package should be transferred.
59+
You will get an automated reply from npm support to your email address.
60+
1. Support will address your request. Please note submitting a report does not
61+
guarantee the transfer of a package.
62+
63+
### Organizations
64+
65+
To dispute an organization name, follow these steps:
66+
67+
1. Open a support ticket at <https://npmjs.com/support>, indicating that
68+
you dispute an organization name. Include the name of the organization,
69+
e.g. `@foo`. Please explain the why you believe the Organizations should
70+
be transferred. You will get an automated reply from npm support to your
71+
email address.
72+
1. Support will address your request. Please note submitting a report does not
73+
guarantee the transfer of an organization.
74+
75+
### User names
76+
77+
To dispute a user name, follow these steps:
78+
79+
1. Open a support ticket at <https://npmjs.com/support>, indicating that
80+
you dispute a user name. Include the name of the user account,
81+
e.g. `@foo`. Please explain why you believe the Username should be
82+
transferred. You will get an automated reply from npm support to your
83+
email address.
84+
1. Support will address your request. Please note submitting a report does not
85+
guarantee the transfer of a user name.
86+
87+
## Trademarks
88+
89+
If you think another npm publisher is infringing your trademark, such
90+
as by using a confusingly similar package, org, or user account name,
91+
open a support ticket at <https://npmjs.com/support> with a link to
92+
the package, org, or user account page on <https://npmjs.com>. Attach
93+
a copy of your trademark registration certificate.
94+
95+
If we see that the user, org, or package publisher is intentionally
96+
misleading others by misusing your registered mark without permission,
97+
we will transfer the account, org, or package name to you. Otherwise, we
98+
will contact the relevant user and ask them to clear up any confusion with
99+
changes to their user account page, or page, or package `README` file.
100+
101+
Use of npm's own trademarks is covered by our Trademark Policy at
102+
<https://docs.npmjs.com/trademark>.
103+
104+
## Changes
105+
106+
This is a living document and may be updated from time to time.
107+
Please refer to the [git history for this
108+
document](https://github.com/npm/documentation/blob/main/content/policies/disputes.mdx)
109+
to view the changes.
110+
111+
## Definitions
112+
113+
### Squatting
114+
115+
It is against npm's
116+
[Terms of Use][acceptable-content]
117+
to publish a package, register a user name or an organization name
118+
simply for the purposes of reserving it for future use.
119+
120+
We do not pro-actively scan the registry for squatted packages, so
121+
the fact that a name is in use does not mean we consider it valid.
122+
The standards for what we consider squatting depend on what is being
123+
squatted:
124+
125+
#### Packages
126+
127+
Package names are considered squatted if the package has no genuine
128+
function.
129+
130+
#### Organizations
131+
132+
Organization names are considered squatted if there are no packages
133+
published within a reasonable time. If an organization is a paid
134+
organization, it may have private packages that are invisible to
135+
third parties. For privacy reasons, we cannot reveal whether or not
136+
an organization has private packages, so a paid organization will
137+
never be considered squatted.
138+
139+
#### User names
140+
141+
We are extremely unlikely to transfer control of a user name, as it
142+
is totally valid to be an npm user and never publish any packages:
143+
for instance, you might be part of an organization or need read-only
144+
access to private packages.
145+
146+
## License
147+
148+
Copyright (C) npm, Inc., All rights reserved
149+
150+
This document may be reused under a [Creative Commons
151+
Attribution-ShareAlike
152+
License](https://creativecommons.org/licenses/by-sa/4.0/).
153+
154+
[conduct]: /policies/conduct
155+
[open-source-terms]: /policies/open-source-terms
156+
[acceptable-use]: /policies/open-source-terms#acceptable-use
157+
[acceptable-content]: /policies/open-source-terms#acceptable-content
158+
[violations]: /policies/conduct#reporting-violations-of-this-code-of-conduct
159+
[trademark]: /policies/trademark

0 commit comments

Comments
 (0)