leftpad was a social issue. It's been solved by policy on the registry side stopping packages depended on by many others being unpublished.
http://blog.npmjs.org/post/141905368000/changes-to-npms-unpu...
The actual disruption however was solved by npm Inc disabling unpublishing (except for some very specific circumstances) and by creating a dummy account unpublished modules are reassigned to to avoid abuse (whereas previously anyone could simply claim unpublished modules and publish new versions).
No, I mean someone retroactively removing a package others were using out of spite.