They weren't defending their trademark. They overstepped their declared industry and maliciously had another's software altered with no valid reason.

NPM should have already had policies in place to prevent this kind of tampering with its repository.