I maintain quite a few high-traffic packages on npm and have done so for years. Npm is really bad about handling any sort of situation with any amount of grace.

Per my anecdotal experience, they are really good at choosing the outcome that benefits them the most/harms them the least - which wouldn't upset me since most companies do this, but it's Npm's "we're here for the community" type of fake attitude that has always bothered me.