[premek]

I don't understand why publishing a new version of a package breaks 1000000s of existing apps?

Do you not depend on a specific version? Do you not use checksums for dependencies?

[orloffm]

Because by default in NPM you reference version ranges using ~ and ^ operators. For sure in a corporate environment no one has time to polish dependencies to specific versions.