Yes, the Atlassian Marketplace Partners are painfully aware of this. We also do not know how to contact these teams as it is not mentioned anywhere in the documentation. The only thing we have to identify teams is this part:
"atlassian": {
"team": "UIP: Cycle Time Flex",
"inPublicMirror": true,
"releaseModel": "continuous"
},
But that is non-descriptive to us.
To be honest, this is exactly what I mean when I refer to bad stewardship in this post. There is no overarching body to control the quality of what is published to NPM.
Anyway, the reason I contacted you and @DanielDelCore is because even if this specific package is created by another team, it is a transitive dependency for @atlaskit/popper on which many DS packages (tooltip, datetime-picker, popup, inline-dialog) rely. I did not get this dependency by manually including some obscure @atlaskit package. I got it from DS team managed components.
Perhaps the DS team should be more strict in terms of dependency management and use specific versions instead of version ranges, as apparently you cannot rely on your own colleagues to not break your packages 