I believe that in the left-pad case, NPM severely violated the overall trust put in their management by handing over a package name (that other people might depend on) without a legal process. Now that NPM has faltered like that once, you basically need to verify yourself that every package that you use is still the same one by the same author, i.e. that NPM hasn't silently transferred the name to someone else.