Ehhhh...... that just makes me feel so uneasy. Things like npm should ideally be maintained by the community or its own organisation. It's too tempting for a big corp like Microsoft to add their own little bits to listed packages here and there. :\\\\\\
It was maintained by a separate (VC-funded) organisation. That got sold to GitHub/Microsoft.