That's actually sort of how NPM works currently, they mentioned that that's exactly how they would solve kik situation, by giving them new version of the package: http://blog.npmjs.org/post/141577284765/kik-left-pad-and-npm

"Had Azer taken no action, Kik would have published a new version of kik and everyone depending upon Azer’s package could have continued to find it."