I wouldn't want my name being forever attributed to something I stopped working on years ago. If I make a lib with my name on it it's my lib and my name's gotta stay on it forever. Feel free to clone it and do whatever you want with it, but this one should stay mine for no other reason than the one we're seeing today. Then link to the latest maintained fork in your README.
The alternative is changing the name (should libfoo.js become libfoo2.js? Libfoo-maintainer_name.js) etc.
Then all the libraries that depend on it have to change their deps and their actual code (require(x) or import x are both based on library name).
If they don’t then any libraries that transitively include the old version of the library could be compromised by any bugs that happen to be included in the old version, so you also can’t say “everyone who cares about the library should update” because library A may depend on library-B which isn’t updated.
If anything the problem here is that npm doesn’t have any real “the maintainer has changed” notification, and that’s couple with the average developer not having any way to know if that change is legitimately ok without auditing the published code.
As the article says, I'm not convinced code signing would have made this not happen - given the distribution model you could trivially just have node library updates check to see whether the owner/maintainer had the same user name.
Similarly it is absolutely not the fault of the old maintainer - no one should have to commit to permanently supporting a library they wrote years in the past. And if you weren't maintaining a library why would you necessarily be opposed to transferring ownership over to someone who is at least apparently working on/with it?