Author of the post here. According to a tweet [1], the user @nj48 seems to be non-malicious.
I updated the blog post.
Nevertheless I find his actions dangerous and irresponsible.
I updated the blog post.
Nevertheless I find his actions dangerous and irresponsible.
I personally think the best course of action would have been for the NPM team to immediately blacklist these names (aside from left-pad, that's a separate conversation) after the entire list of unpublished packages was shared, and then make them available on a case-by-case basis.