I've been reading up on the npm left-pad fiasco, but I'm somewhat confused by how it happened