"In March 2016 Azer Koçulu unpublished kik and 272 other npm packages including left-pad, disrupting many thousands of projects for about 2.5 hours."
npm's incident report establishes the package removals, widespread breakage, and roughly 2.5-hour disruption; the disruptive protest action was unpublishing rather than malicious code inserted into left-pad.
View Source