[bigiain]

> Benefit of the doubt says that they thought they were publishing privately.

In what world is pushing your source code to a venture backed (therefore viral growth oriented) company who promote themselves with "npm Inc supports the JavaScript community by providing the registry where developers publish and share packaged open-source modules" possibly consistent with a view that "they thought they were publishing privately"???

Sorry, but I just don't buy that.

Somebody at the bank fucked up. It cannot possibly be npm Inc's responsibility to detect and somehow police that.