His account has a published package available that was pushed about 3 months ago - hardly dormant, and based in their disputes process [0] it seems unlikely anyway:
> To dispute a user name [...] After 4 weeks, if the owner has not responded, support will address your request. The ultimate outcome is at their discretion and judgement.
And this statement on squatting confirms that it would be 'extremely unlikely':
> We are extremely unlikely to transfer control of a user name, as it is totally valid to be an npm user and never publish any packages: for instance, you might be part of an organization or need read-only access to private packages. If a user has not logged into their account in a long time, we may consider transferring a name if it is requested by a new user.
There was no activity on the package for 3 months when I wrote this! By his logic, that would qualify for someone else to take over the account if they like the username.
