Rewindex

CompaniesnpmIncidents

npm: Issue connecting to website and registry

MajorStatus: resolvedStarted Resolved (40 min)3 updatesstspg.io (opens in new tab)
Part of an outage event

Cloudflare outage, Dec 5, 2025 · 46 vendors, 46 incidents

npm’s incident started in the same window without naming Cloudflare (timing only, not evidence of a link). (timing only, posted +16 min vs the first vendor naming Cloudflare)

Swipe sideways to see the whole diagram.

same windowCloudflareown incident not archivedWithin an hour18 vendors, 18 blamed CloudflareUnbounce, Expo, GitLab +151 to 4 hours later1 vendor, 1 blamed CloudflareKlaviyoLater2 vendors, 2 blamed CloudflareBitrise, Sigma Computingnpm (this incident)posted +16 min
same windowCloudflareown incident not archivedWithin an hour18 vendors, 18 blamedCloudflareUnbounce, Expo, GitLab +151 to 4 hours later1 vendor, 1 blamed CloudflareKlaviyoLater2 vendors, 2 blamed CloudflareBitrise, Sigma Computingnpm (this incident)posted +16 min
npm is outlined in red. Groups show up to a few vendors each; the event page lists every incident.
Mermaid source
flowchart LR
  root["Cloudflare<br/>own incident not archived"]:::inferred
  h1["Within an hour<br/>18 vendors, 18 blamed Cloudflare<br/>Unbounce, Expo, GitLab +15"]:::blames
  root --> h1
  h4["1 to 4 hours later<br/>1 vendor, 1 blamed Cloudflare<br/>Klaviyo"]:::blames
  root --> h4
  later["Later<br/>2 vendors, 2 blamed Cloudflare<br/>Bitrise, Sigma Computing"]:::blames
  root --> later
  me["npm (this incident)<br/>posted +16 min"]:::me
  root -.->|"same window"| me

Full event: timeline, evidence and all vendors →

Detected automatically from incidents that started together and named the same provider. A link means one vendor’s incident named another, not a confirmed cause.

Affected components: Security AuditPackage searchReplication FeedPackage publishingPackage installationwww.npmjs.com website

Timeline of updates

  1. investigating

    We are currently investigating this issue.

  2. monitoring

    A fix has been implemented and we are monitoring the results.

  3. resolved

    This incident has been resolved.

Changes Rewindex caught on this incident

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.

How the archive is checked, and what it cannot prove.

This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.

Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).

npm profileRecent npm incidentsMarkdownJSON