losing the "momentum" on an abandoned package is a much better choice than having it fall into the wrong hands together with all the people who use it and didn't even know about the change of owner.
1. Dead project
2. You share access to lots of people and they act responsibly
3. You share access to lots of people and they act irresponsibly
#2 is waaaay more likely than #3.
Still seems to me like people are blaming the wrong person here. If you're writing a cryptocurrency-related module (the target of this specific attack) and you're using npm modules written by somebody you don't know, what the hell are you doing?