Publishing a package on npm is not much more than uploading a .tgz. You could put _anything_ in it as long as it has a package.json at its root. Nothing is done

Publishing a package on npm is not much more than uploading a .tgz. You could put _anything_ in it as long as it has a package.json at its root. Nothing is done on Npm's side to ensure things are what they claim they are upon publishing: they only check (superficially) if you are not by any chance trying to republish the latest version. Even that is done locally, not at the registry level.