Repository navigation
Owner access for the administrative members in the npm organization #630
Description
Currently, the only owners in the npm organization are @darcyclarke and @wesleytodd. Shouldn't all administrative members be owners in the npm organization?
At the moment, the remaining administrative members are just admins
Activity
darcyclarke commentedon Jul 16, 2025
I wasn't aware of this but you're right - it looks like @wesleytodd & I are the only "owners" in the
pkgjsorg right now. I'm not sure what the process is/documentation says about this or what the appropriate level of access should be fornpmjs.comorg members (I did a quick search of our governance docs & came up with nothing - maybe @mhdawson / @wesleytodd know or @bjohansebas, if you already know, feel free to share links/refs). I can definitely help fix any incorrect permissions but would want to understand how we determine who is a "member" vs. "admin" vs. "owner" as well as how we'll keep this mapping of users/access up-to-date (ie. do we check this quarterly/annually/ad-hoc & who gets what access?). I ask this because there's also a bunch of "members" in thatpkgjsorg & it's not clear why they aren't also "admins", "owners" or purged.In practical terms, the only differences I know of between an "admin" & "owner" today are the ability to add/remove other owners & to transfer packages out of an org. Here's a breakdown of the permissions as far as I remember from my time at
npm:wesleytodd commentedon Jul 16, 2025
Yeah I was the person who registered the org, so makes sense I am. I also agree this is a gap in the process/documentation. At the time, IIRC, the idea was just to keep it low effort to unblock a bunch of shared goals. Now that progress on a bunch of those has stalled, maybe it is time to reassess?
bjohansebas commentedon Jul 16, 2025
While it doesn’t explicitly state that they should be owners within the organization, an administrative member has the responsibility of managing the pkgjs organization (this is in the governance file), so in my understanding, this includes the npm organization as well. Therefore, they should have the highest level of permissions in order to manage it properly, because as an admin they don’t have all the permissions that an owner has. Now that I realize, not all administrative members are owners in the pkgjs GitHub organization either, only a few are.
A member would be someone who is helping with a specific package within the pkgjs organization. An admin or owner (since it’s not clear whether an administrative member should have that role) should be the administrative members.
Probably ad-hoc? There are very few people in npm compared to the list of members in this group, so such a frequent review isn’t really necessary either.
These are the current permissions within the organization. https://docs.npmjs.com/organization-roles-and-permissions
wesleytodd commentedon Jul 16, 2025
Oh, and I forgot, one other thing we didn't have answered at the time was if folks were comfortable with publishing under the
@nodejsscope. It is being used now, but wasn't at the time, and we didn't want to worry about the requirements that "being official" needed. It is quite possible that the org could just be retired and the packages could be managed under the mainnodejsorg?bjohansebas commentedon Jul 16, 2025
I think at this point we would be fine moving the scope to
@nodejsfor the future and retiring that organization on npm.Are you referring only to the npm organization or also to the GitHub one?