I do not think NPM altered a package, they unpublished the nonfunctional/infinite-loop version, so that the prior, functional, version (pushed by marak) becomes the "latest" version again
Yes, that is a very dangerous precedent. This isn't like the leftpad issue where someone stole credentials from the project owner. This is the project owner himself publishing a new version of his project.