As far as we know, NPM's solution was to flag the organization (making the links to the issues within the article useless) and to remove the packages without any policy change.