[hobofan]

Damn, I didn't even know that npm allows publishing dependencies that have git/https dependencies to the public registry.

[paulddraper]

You can publish with any dependency including non existent ones.

There’s not a lot of restrictions npm puts on what you can upload.