Kik, Left-Pad, and NPM (blog.npmjs.org)

And the outcome:

Kik never released the NPM package they claimed they would.

After NPM took over the name, the kik package got replaced with malware (????) https://www.npmjs.com/package/kik