You're conflating two things: the npm package, and the GitHub repo. In your hypothetical, I agree with you that action would be needed: the repo should be forke

You're conflating two things: the npm package, and the GitHub repo. In your hypothetical, I agree with you that action would be needed: the repo should be forked and patched, and NPM should publish the new release as the official npm corejs package. This has accomplishes the same while trampling as little "ownership" as possible.