One question GitLab's CEO (sytse) is rightfully asking is whether the ability to trace code from npm back to the repository will be available to competitors. If not, less competition is bad for users.
I still think this is good news, given where npm is coming from, but it's certainly not risk-free.
This is where effective anti-trust enforcement is important and valuable.
Until we come up with better trusted federation protocols there will be natural monopolies, but that doesn't mean they get unchecked power. We have laws for that.
I still think this is good news, given where npm is coming from, but it's certainly not risk-free.