Fool me once, shame on you. Fool me twice, shame on me.

I get that this royally inconvenienced a ton of people, but come on: the fact that this can happen in the first place, along with the fact that the expectation for most users is that it can't, is a clear failing on NPM's part.

I don't know what the solution is - maybe packages should be permanent after 24 hours instead of after they're depended upon, maybe there's a different solution - but it's disheartening to see the vitriol with which folks went after PatrickJS in the screenshotted comments in TFA.