There is an issue not being discussed here. The guy is almost homeless. He is probably angry and has nothing left to lose. Now think about all the damage he can

There is an issue not being discussed here. The guy is almost homeless. He is probably angry and has nothing left to lose. Now think about all the damage he can do by having his open source project being used by so many people and companies. He can deploy a malware or ransonware and even if he doesn't make a penny, he can create some chaos. This is the real risk of relying on a fragmented open source ecosystem, especially the NPM platform. Pinning is not enough when every Node project uses so many dependencies coming from so many developers.