And now I see ucoin being semi-revived on npmjs again

Continued thread from:

Well this is confusing. First abandoned, now it’s being worked on again?

And guess what I’ve done as soon as I discovered that “No, I don’t have to pay for hosting packages on npmjs. Only those who wish their packages to be private.”, which coincidentally happened at the same time as the name change?

Does Windows/MacOS make use of npmjs?
I hate deprecation warnings, but I can’t find MD5 in package.json. Where is decided what version of MD is downloaded?