FYI, This beta was published as dist-tag latest which means npm install diff will install the beta, which may be unexpected. It's better to publish betas under their own dist-tag, like beta.

Oh, man! Thanks for letting me know; it's my first time helping maintain an npm package and I hadn't really noticed tags were a thing nor realised they'd affect npm install behaviour. (I wrongly assumed it was semver-aware and wouldn't install a pre-release version unless explicitly asked to; I should've checked with a test package.)

It's a common misunderstanding with npm, I've seen it too many times. To fix, you could publish the v6 beta again using npm publish --tag beta and then publish another v5 release without the --tag argument.