The following entries have a .cabal but no package.json file in 01-index:
Note that glue-ekg has two versions after 0.4.4 (by April 15).
Dates of these releases don't seem be related to April 15:
@edsko it would be good to review the hackage-security code (I guess?) to see what could cause this. I can take a swing myself, but any hints or suggestions as to potential trouble spots from someone more familiar would be quite welcome.