A date picker widget I tossed on NPM 13 years ago gets 32,000 downloads per week. 510 a week is background activity, that's indexing bots or one org's CI system.

I totally agree. I thought about adding a paragraph about how it seems like even oracle themself doesn’t use it on production (cause otherwise it’d have probably more downloads due to developers, CI, you name it) but it is possible they use a internal npm proxy with a cache. Anyway it’s laughable that this package is the reason they base their argument on.

In the Node world that's basically a side project of a single dev.