I didn't mention it in the post, but npm was patched up before the update was publicly released. The CouchDB team coordinated with some of the bigger customers in advance (I also specifically requested that they do this in my original bug report).
We are using many CouchDB servers and I can confirm that we got a heads-up plus a patch several days before the 1.7.0 release. The CouchDB team and the Hoodie team did a great job handling this issue.