When a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed. Of course, this

When a package transfers ownership or is removed/re-added, it's not possible to republish the same version as one that has previously existed. Of course, this doesn't save you if you're installing `^1.0.0`, the maintainer deletes the package, and someone else uploads a malicous `1.0.1`. The package.json should allow pinning publisher usernames and optionally public keys, and shrinkwrap should pin hashes, not just versions.