npm itself does not collect or store enough information to charge your card itself. Rather, <a href="https://stripe.com/">Stripe</a> collects that data on npm's behalf, and gives npm security tokens that allow npm to create charges and subscriptions.</p>