US trademark is what's dangerous to NPM Inc., the US company running NPM. We don't know anything about how they "handled" it before it came to this, except that they did decide against the article author. What should they have done differently?

It's not good that NPM-the-piece-of-infrastructure is vulnerable to this, maybe a registry like this shouldn't be under control of a single company, but we don't know enough to decide what options NPM Inc-the-company had.

I hope they clean up/better communicate their policies around this, once they have them figured out (e.g. the package dispute page doesn't discuss trademarks).

> What should they have done differently?

Not given them control over his code just because it had their name on it. They could have taken it down, but they didn't, they just gave some company ownership of his module, not cool.