>...they can even modify already-released packages.

I keep seeing people say that, but NPM rejects it if you try to publish a version that already exists. Am I misunderstanding what the author is saying?