Regarding (b), did NPM itself have any legal liability? If not, they could simply say "your beef is with the author of the package, but we'll of course comply with a court order that requires us to transfer ownership".

(I suspect, though, that NPM might have some legal liability, and Kik [the company] could sue them regardless, which would suck for them.)