The dev could claim something like "prior art", or whatever the alternative is for software. Suppose I trademark the name "is-odd" for a company, should NPM now hand me the "is-odd" package name? This would surely break the internet in the same way is an this case.