NPM's terms of service indicate they can refuse service for any reason, and the package's own license of GPL indicates that NPM legally can distribute it without the author's consent otherwise. Even if the package was not license as such, NPM's terms of use indicate you grant them an irrevocable license to distribute what you upload. Unlike some social media platforms, they don't reserve the right to sublicense it, but they do require you agree they aren't the ones liable if someone they distribute it to breaches the license.
Why would it break people's builds? I can only see this happening if they upgraded faker.js.
Besides, best practice says to check each package's repo before upgrading because of 1) malware, and 2) potentially breaking changes.
Also, many forks exist, and you can point to GitHub versions of a package.
Then NPM reverted the last version to unbreak things probably suspecting his account had been hacked. Fair enough.
Now what happens when the author declares it was him? Is it his right to push a broken version? Is it his right to delete the npm package entirely? I'm sure there are some npm terms of service around this, but it's an interesting scenario.