It used to be a "gentleman's agreement," but now npm enforces it - as a result of this guy's actions.