Update: I was in fact incorrect about the severity of the rubygems.org incident; their issue was a disclosure without a breach, exactly like ours. I've updated the original post and also issued a correction:

http://blog.npmjs.org/post/78165272245/more-help-with-self-s...