Any npm downloaded after ~August of 2012, which is when the GlobalSign CA was added to the client:

https://github.com/npm/npmconf/commit/d7ef61c8d9ae87f39482c5...

I believe we considered adding the npmCA and dismissed it, but it has been a long week and I can no longer recall why. I will bring it up and post an update here next week.