Johnny says open source projects need a plan for survival because unpaid work and issue support do not scale indefinitely. At Adremotion, he wanted to test selling desirable React components while keeping essential parts available.
NPM Kiosk and Open Source Monetization
Speakers
Johnny, who built npm Kiosk at Adremotion, explains how it can make selling private npm packages easier, with Callstack host and Miho Peshawa discussing their own experience with private registries.
Miho describes using a private registry to let testers try Reassure before it became open source. Setting up access through Bytesafe involved team assignments and manual steps for roughly 50 sign-ups. The friction discouraged early adopters, so the team dropped the approach.
Johnny’s idea is to serve a private npm tarball through a link to a serverless function. The function can check a receipt, authenticate a user, or apply rate limits before allowing a download. For payments, he uses a Stripe Payment Link and its receipt ID as the download secret, avoiding a separate database.
Johnny says Kiosk was not yet in production for his own packages, though he sold five copies of Kiosk itself for $200. A download secret can leak if committed in a public repository, and revocation is possible but does not make the system perfectly secure. Buyers also asked for features such as subscriptions, Python support, Bitcoin, Gumroad, and free trials, showing that one setup does not fit every use case.
Takeaways
- Reduce setup steps when inviting beta users, since registry configuration can keep interested testers from trying a package.
- A serverless download gate can check payment or access conditions before serving a private package tarball.
- Stripe Payment Links can provide a simple payment flow and receipt identifier without building a payment system or database.
- Decide how much piracy risk is acceptable by weighing it against the friction added by stronger access controls.
- Validate buyers’ needs early: requests for subscriptions, other languages, and payment providers can reveal gaps in product fit.
Mentioned in this talk
Search inside this talk
What was claimed 10
- featureCallstack Team: Hosts the Coffee Talk podcast
“the Coffee Talk podcast by Callstack”
YouTube Unverified1 source· Talk
- uses
“similar to the strategy Remix used when they first announced their library”
YouTube Unverified1 source· Talk
- usesMiho Peshawa uses Bytesafe
“We used Bytesafe.”
YouTube Unverified1 source· Talk
- featurenpm Kiosk: Serves private package tarballs through a link, with optional validation
“a serverless function that grabs that private package and forwards it to the client, with some possibility of validation”
YouTube Unverified1 source· Talk
- featurenpm Kiosk: Uses the transaction receipt ID as the download secret
“we have a transaction receipt ID. I can use that ... as the secret for downloading the npm package”
YouTube Unverified1 source· Talk
- integrates with
“I decided to use a Stripe Payment Link”
YouTube Unverified1 source· Talk
- featureStripe Payment Link: Supports a custom redirect URL after payment
“After you pay through the Payment Link, you can set a custom redirect URL”
YouTube Unverified1 source· Talk
- featurenpm Kiosk: Checks purchases through the Stripe API without a database
“Whenever we need to see whether somebody bought it, we just call the Stripe API”
YouTube Unverified1 source· Talk
- metricnpm Kiosk: 5 copies sold for $200
“I've sold five copies of it and made 200 bucks from it”
YouTube Unverified1 source· Talk
- featurenpm Kiosk: Download secrets can be exposed if committed in a public repository; secrets can be revoked
“you commit the secret. If you push that to a public repo, you can leak it”
YouTube Unverified1 source· Talk
