node package manager

What domains does npm use?

How can you tell an email or domain really belongs to npm and isn't a phishing attempt? Here's a full list:

Active domains

Formerly used


We own these but don't use them for anything (yet).


This is a living document and may be updated from time to time. Please refer to the git history for this document to view the changes.


Copyright (C) npm, Inc., All rights reserved

This document may be reused under a Creative Commons Attribution-ShareAlike License.