in general npm does a not-too-great job with these things

Remember, NPM stands for Now Part of Microsoft!

(Microsoft owns GitHub, which owns NPM.)

Which means they don't have the excuse of being a volunteer effort to not be on top of this. MS has plenty of resources.

	▲	dabockster 4 days ago \| parent [-]
		If you're running this kind of infrastructure online these days, you have every right to require payment somehow. Don't work for free.