> Well first we need to know how people would discover it. There's a couple obvious ones...

npm emails you by default whenever one of your packages has been published (even by you), so I imagine that would be the most likely way that the problem would be detected in practice.