NPM is... special... It's up to platform owners to set standards and police. NPM's failures have nothing to do with open source as a whole.