What is the legal basis for the claim that NPM package names are somehow exempt from trademark and other law?

NPM does not offer packages as commerce. The package removed was not used in commerce. The KIK trademark does not claim any functionality related to the removed module.

What legal basis is there that NPM packages are subject to trademark, or other law?

NPM takes its names from the package.json file. The law has no say over what one may put into their package.json file.

Offering a product/service for free doesn't exempt it from trademark law. I couldn't make an open source word processor and call it "Microsoft Word".

The US Federal Government only has the ability to regulate interstate commerce. Kik, the project, does not engage in commerce. Also, npm (the package manager) is not a commercial vehicle.

>I couldn't make an open source word processor and call it "Microsoft Word".

Sure you could, you just couldn't use it in commerce.

> There are no legal claims to be made over NPM package names.

Why not? An NPM package name is the name of a piece of software, and software names are very much covered under trademark law.

An NPM package name is just what NPM scraped from a package.json file.

The technical details of how package names enter their system aren't really relevant from a legal point of view.

I believe that is what I said.

> There are no legal claims to be made over NPM package names.