[rspeer]

I was replying to 0x0's claim, not making a broad statement about npm's policies.

0x0 claimed the code uploaded as duplexer3 was "undesirable code" and implied that it was a "malicious actor". It was completely utterly benign.