PayDev: FOSS Monitization or new supply chain attack?

My response:


I’m all for monetizing FOSS work but

The idea is that the package will no longer be available on NPM

This sounds like a supply chain attack to me(see colorsjs0). What you are proposing will require devs to yank packages off NPM and republish on the PayDevs registry, which will break builds globally.

A less damaging option(and maybe more attractive one too), would be encouraging devs to publish only AGPL/GPL packages on the public NPM registry and selling more permissive licenses using your implementation.

Regards,
Aravinth Manivannan