The keyword is malicious, which does not lend nicely to be deconstructed by reductionism. If the intent of the push was to damage downstream users of the softw

The keyword is malicious, which does not lend nicely to be deconstructed by reductionism. If the intent of the push was to damage downstream users of the software then it is malicious towards them.