It doesn’t seem like disclosure was coordinated with NPM itself - which usually wouldn’t be a problem as it’s the software user’s responsibility to follow patches and stay up to date. But in this case it seems funny that NPM wasn’t considered a principal party for responsible disclosure given the entire context of the investigation.