Why did you update to a new version of Coffeescript and not know about this bug before it made it to your production environment?
I agree that Coffeescript should probably just use semver. But they don't, and you have no control over that.
What you do have control over is when you update your dependencies and whether or not you validate releases before deploying to production.
It seems a little disingenuous to act like this is entirely Coffeescript's fault.
npm saw that there was a new version of a dep that was advertised as being backwards compatible, so it installed it. Then things broke.
The prevention to this is npm shrinkwrap. Had that been used on this particular service, it would have continued installing coffeescript 1.4.0. It also would have missed out on any security patches, bugfixes or performance improvements that may have happened in the meantime.
This is why npm shrinkwrap exists.
But anyone who's had an app in production for very long learns pretty quickly that you you use "1.8.0", not "^1.8.0" if you don't want things to break.