A new release of the JavaScript and Node.js package manager, npm, fatally changes file permissions. While that's been fixed, the entire messy process revealed more fundamental problems.