I didn't get into JavaScript development until about 2016-ish. Therefore, I missed a lot of the early stages of Node.js (and the io.js fork), npm, the rise of all of the frontend frameworks, etc.

To my surprise, I learned recently that npm, the package manager that ships by default with Node.js, is actually controlled by a for-profit company and it is not open source.

Python's pip and Java's Maven are both open source, and that seems to be the default for other programming language's package managers.

There has been a lot of chatter and concern on Twitter about:

• moving the registry to the JS Foundation
• making it decentralized
• contingency plans should the company sell to a bad actor.

I have some questions I'm hoping someone with context can answer for me:

• Was npm always a for-profit company or did it start open source and eventually incorporate?
• How did Node.js decide to partner and ship with npm?