What! That completely violates any reasonable expectation of what that could be referring to.

I wonder if npm themselves could mitigate somewhat since it's relying on their GitHub integration?