Looks like they use SHA-1 hashes, though. Please, let's get rid of SHA-1 already.
http://blog.npmjs.org/post/141905368000/changes-to-npms-unpu...
The actual disruption however was solved by npm Inc disabling unpublishing (except for some very specific circumstances) and by creating a dummy account unpublished modules are reassigned to to avoid abuse (whereas previously anyone could simply claim unpublished modules and publish new versions).
No, I mean someone retroactively removing a package others were using out of spite.
For e.g. Facebook, I bet they have some online filesystem like NFS or similar, that hosts the global yarn cache for their continuous integration system. This way, their CI system doesn't call out to the cloud for every build.