What was the "other side" of leftpad? As far as I remember, the broken system wrought havoc, not the developer who chose to withdraw his modules. I don't think the developer's reasons are much relevant when discussing how reliable their word is.
OK, so the is more to it than that and he did have a genuine grievance (I forgot exactly what) bit in dealing with that he caused a pile collateral damage for innocent bystanders.
(Innocent bystanders who errantly put too much faith in dependency oriented programming which brings us back to the broken system)
That said, the system is definitely broken.
His reaction to the Kik thing is probably where he was at fault, I think it would have been reasonable for him to back down there; companies, in the US at least are obligated to protect their IP in order to retain their rights over it (as far as I have understood from various discussions on HN), but perhaps the forceful lawyering got his back up?
Also I have no idea of jurisdiction of any parties involved, I just assume US.
and who need an external package to leftpad a string... the most fascinating part of that story to me...
Which is why it's a distraction to even consider this particular person's track record.
Even if this same person pulled one critical package a month for the next year, the fundamental problem is still that the ecosystem in general relies on parties with no obligations to manage critical dependencies.