I think as JS developers, this should be a wake-up call, to never trust npm semantic versioning if your project it's critical. In this case, it's a dev who dec

I think as JS developers, this should be a wake-up call, to never trust npm semantic versioning if your project it's critical. In this case, it's a dev who decided to use his right of doing political activism at the cost of his reputation. But this it's a best-case scenario. Another dev of a popular NPM library could get hacked, and insert malware. I wonder if there are zombie servers out there mining crypto or doing DDoS, just because an obscure library dependency of a dependency of a dependency, got compromised. I don't think Marak was "right" (In bird culture that is considered a d*ck move), but legally he owned nothing to anyone. Adding a new update to production without testing first, it's in the hands of their devs of the apps, not him.