+1 also US Trademark != the whole world. NPM should have handle this better!
It's not good that NPM-the-piece-of-infrastructure is vulnerable to this, maybe a registry like this shouldn't be under control of a single company, but we don't know enough to decide what options NPM Inc-the-company had.
I hope they clean up/better communicate their policies around this, once they have them figured out (e.g. the package dispute page doesn't discuss trademarks).
Not given them control over his code just because it had their name on it. They could have taken it down, but they didn't, they just gave some company ownership of his module, not cool.