NPM expects packages to follow semantic versioning. If a package contained a breaking change like that, there would be a major version bump, and you'd have to u

NPM expects packages to follow semantic versioning. If a package contained a breaking change like that, there would be a major version bump, and you'd have to upgrade manually. If the maintainers wasn't acting maliciously, they could change this new version to count as a major release, and then it wouldn't be a DoS.