I didn't see anyone mention the amount of libraries this is depended on in in the comments. according to npm's site, it's 441 as I post this. The developer himself claims about 33340 other projects use it. (or at the very least, that's what his automated use counter says: https://raw.githubusercontent.com/standard/standard-packages... )

Probably a good thing this was caught early, as the typically large number of node.js dependencies required for a package could have led to some sort of combinatorial explosion of ads on install.

Even assuming that any one ad package checked to make sure it only displayed ads once per session, very many people would want to put an ad into some library somewhere, especially if they have existing users/dependants for their pre-ad version. Careful maintenance would be needed to avoid putting other people's ad code in yours, but also keep it up to date to fix exploits.