But you can just curl it again in a few minutes and bring it down again. And then again after that, so they claim that it can be done indefinitely. That’s quite a big difference.

Also, you can target not just express but an even higher volume small library that most large projects depend on.

I don’t get how every comment so far has dismissed DoS as a serious issue.

On it's own probably not. Given the way that people hook npm into automated deployments it likely can rise to that level for some users. Given that some people may depend on this deployment strategy without even being aware of it, it does seem like an issue worth noticing.