`npmjs.com` & `github.com`'s Terms & Conditions seem at odds

Current Behavior

• npmjs.com's Terms & Conditions references the following item 4. of "Conditions"...

"You may access and use data about the security of Packages, such as vulnerability reports, audit status reports, and supplementary security documentation, only for your own personal or internal business purposes. You may not provide others access to, copies of, or use of npm data about the security of Packages, directly or as part of other products or services."

ref. https://github.com/npm/documentation/blob/8c9313d9161a0db06466681163d2fa6a3bf49858/content/policies/open-source-terms.mdx#L122-L127

Expected Behavior

• npmjs.com should have similar language/aligned with github.com's Advisory Database Terms & Conditions

"The GitHub Advisory Database allows you to browse or search for vulnerabilities that affect open source projects on GitHub.

License Grant to Us

We need the legal right to submit your contributions to the GitHub Advisory Database into public domain datasets such as the National Vulnerability Database and to license the GitHub Advisory Database under open terms for use by security researchers, the open source community, industry, and the public. You agree to release your contributions to the GitHub Advisory Database under the Creative Commons Zero license.

License to the GitHub Advisory Database

The GitHub Advisory Database is licensed under the Creative Commons Attribution 4.0 license. The attribution term may be fulfilled by linking to the GitHub Advisory Database at https://github.com/advisories or to individual GitHub Advisory Database records used, prefixed by https://github.com/advisories."

ref. https://github.com/github/docs/blob/main/content/site-policy/github-terms/github-terms-for-additional-products-and-features.md?plain=1#L67-L77

IANAL, but when npm switched to proxying through to the GitHub Advisory Database the results of the security audit endpoints indirectly assumed the license/terms of that data. It seems (& again, IANAL) incorrect that any data returned from those endpoints would not be covered by the same CC 4.0 License which explicitly states "You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits."

Start with content/policies/open-source-terms.mdx, especially the referenced Conditions item 4, and compare it with the Advisory Database section in the linked GitHub terms document. Confirm the applicable licensing and usage language with the project before deciding whether the npm terms should be revised; the work is done when the policy relationship and any required wording are resolved.