I was replying to 0x0's claim, not making a broad statement about npm's policies. 0x0 claimed the code uploaded as duplexer3 was "undesirable code" and implied

I was replying to 0x0's claim, not making a broad statement about npm's policies. 0x0 claimed the code uploaded as duplexer3 was "undesirable code" and implied that it was a "malicious actor". It was completely utterly benign.