It's not actually published on npmjs.org. Author probably just ran npm init out of force of habit. It's actually quite nice that they have their standard metadata & licence where it's easy to find.
They should probably have private: true in there though, to stop it getting published by mistake, since it isn't a component anyone could usefully import.
They should probably have private: true in there though, to stop it getting published by mistake, since it isn't a component anyone could usefully import.