Here's a hypothetical, but extremely plausible scenario. Lets say tomorrow a major security vulnerability is discovered in CoreJS. Full root access because I'm

Here's a hypothetical, but extremely plausible scenario. Lets say tomorrow a major security vulnerability is discovered in CoreJS. Full root access because I'm making this all up. NPM says core-js has 19k dependents, so it would be very preferable if an X.Y.1 release could be pushed with a security only fix, to be picked up in as many projects as possible. In that case, I think it would be extremely reasonable for NPM to decide to take action. For example, they could take the package over themselves and publish a patch release. Or they could temporarily add maintainership to a trusted member of the community. No solution is without problems in this scenario, but there would be good arguments for either of those serious actions.