NPM does not offer packages as commerce. The package removed was not used in commerce. The KIK trademark does not claim any functionality related to the removed module.

What legal basis is there that NPM packages are subject to trademark, or other law?

NPM takes its names from the package.json file. The law has no say over what one may put into their package.json file.

Offering a product/service for free doesn't exempt it from trademark law. I couldn't make an open source word processor and call it "Microsoft Word".

The US Federal Government only has the ability to regulate interstate commerce. Kik, the project, does not engage in commerce. Also, npm (the package manager) is not a commercial vehicle.

>I couldn't make an open source word processor and call it "Microsoft Word".

Sure you could, you just couldn't use it in commerce.