What domains does npm use?

How can you tell an email or domain really belongs to npm and isn't a phishing attempt? Here's a full list:

Active domains

Formerly used


We own these but don't use them for anything (yet).


This is a living document and may be updated from time to time. Please refer to the git history for this document to view the changes.


Copyright (C) npm, Inc., All rights reserved

This document may be reused under a Creative Commons Attribution-ShareAlike License.

Last modified September 19, 2017           Found a typo? Send a pull request!

npm Services

Getting Started

How npm works

Private Modules


Using npm

CLI Commands

Configuring npm

npm policy documents

View All On One Page