Npm operational incident, 6 Jan 2018
&gt; Unfortunately, the process was complicated by well-meaning members of the npm community who believed that a malicious actor or security breach was to blame and independently attempted to publish their own replacements for these packages. Ensuring the integrity of the affected packages required additional steps and time.<p>That is such a bad response to this.<p>The problem isn&#x27;t that &quot;well-meaning members of the community&quot; decided to upload packages. The problem is that when their system decides that a package shouldn&#x27;t be up it completely removes the package, as if it never existed, and allows the namespace to be reused immediately. Those &quot;well-meaning members&quot; should not even be able to hijack packages this way, as it means the people who aren&#x27;t &quot;well-meaning&quot; can also do it.<p>What should happen is that they block downloads of the package while they investigate. That way people who attempt to download the packages get a meaningful error and people are unable to hijack the package name.