Maintainer email addresses on npm and PyPI are publicly exposed to anyone

A developer found that npm's public registry metadata lists the maintainers of packages, including 53 email addresses for the small utility ms, with no login or rate limit needed to retrieve them. Some of these are personal Gmail or iCloud accounts, while others belong to companies such as Vercel, Google, and Microsoft. The author notes that PyPI exposes similar author and maintainer email fields, though it appears to show more shared team addresses than individual ones. Security researchers at Snyk have warned that attackers could use these lists to find weak points, such as expired domains used for password resets, or to build targeted phishing lists. The author argues this exposure matters because the addresses remain permanently listed even for obscure dependencies that maintainers may have forgotten about.