I think they can argue that the code is their property and that the employee that published it on NPM had no mandate from the company to do so. So it's effectiv

I think they can argue that the code is their property and that the employee that published it on NPM had no mandate from the company to do so. So it's effectively "stolen code" in a sense, just as if the employee had done it to harm the company on purpose.