Interesting. So he got upset with his project and pushed a new version to NPM which was an empty repo, breaking lots of people's builds. Fair enough I suppose. It's his project.

Then NPM reverted the last version to unbreak things probably suspecting his account had been hacked. Fair enough.

Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario.