When the nodejs-sig group was created the existing owners of the various nodejs package ran script to give it ACLs on their packages and it seems a small number of non-nodejs packages accidentally got ACLs in the process. Those which I know to be affected are:

and -- Auto nice daemon
atomic -- Tool for managing ProjectAtomic systems and containers
be -- Bugs Everywhere, a distributed bug tracker
escape -- Extensible block-pushing puzzle game
mock -- Builds packages inside chroots
pony -- An image manager
simple -- Asynchronous HTTP server for Java

I did email the owners of those packages about four months ago when I first noticed, and have chased several of them since but to no effect.

If the group::nodejs-sig ACL could be removed from all those packages then that would be very helpful.