Jasnell had a post What If npm Ran on AT Protocol? that couldn't have come at a better time as I was recently laid off and wanting to build something new. I'd been musing this idea for a while and with someone else validating it's not as batshit crazy as I originally thought gave me the motivation to dive in and finally build it.

atpm.dev

Package management for the decentralized web built on the AT Protocol with a passthrough to the public NPM registry.

AT Package Manager works by publishing each package as an AT Protocol record with version tarballs in the users PDS. The registry resolves handles to DIDs, serves packages over an npm-compatible API, and falls back to the npm registry for anything not published to the AT Protocol.

atpm.dev is hosted on Cloudflare Workers and is self hostable with the source available at jacob-ebey/atpm. Currently, the indexer service is being ran on a Raspberry Pi in my living room.

Give it a go

The only requirement to consume from ATPM is to point your package manager at https://atpm.dev. This is usually done by creating a .npmrc file in the root of your project.

registry=https://atpm.dev

With support for trusted publishing and OIDC support for GitHub workflows, publishing is as easy as configuring the repository at https://atpm.dev/dash/publishers and a simple workflow.

name: Publish
on:
  push:
    tags:
      - "v*"
permissions:
  id-token: write
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - run: npm stage publish