We'll see if there is any real policy change. I hope there is, at the very least to avoid another instance of this mistake, but also to prevent genuine targeted abuse of this policy failure.

For now, NPM is slowly taking all the packages down, and GitHub has forcefully made the org private: https://imgur.com/a/WuSpBQi