I'm glad to see this come back up (even though the title frames the issue entirely backwards: it's less about one guy breaking things and more about the malpractice of building systems that are brittle from day one) because I don't think folks have really learned from the perils of unnecessary yet load-bearing dependencies.

At the very least, I hope the conversation is still alive enough for groups to invest in mirror registries to have some form control over external dependency sources. At [previous gig], it's something that always felt like an expense that needs a lot of justification with the powers that be despite feeling like table stakes for keeping a revenue-generating app up in the long term.

People still use Kik? I wasn’t aware it was still a thing… using lawyers as a threat on an npm package is such a lame and small move…

The obligatory XKCD reference:

https://xkcd.com/2347/

BTW maybe you should add (2016) to the title.