Did you know that following the acquisition of NPM by Microsoft, one of the founders manually uploaded a package for old times' sake?
I think that the uploaded contents didn't in fact match the commit/tag that they appeared to. I could be mistaken, it's been a while and I didn't keep detailed notes on that.