That sounds reasonable. In this case, if the author had updated the documentation sufficiently along with the change to make it clear what the new behavior was

That sounds reasonable. In this case, if the author had updated the documentation sufficiently along with the change to make it clear what the new behavior was, that would have been fine? I agree that malware is unhostable. And in this case I think the author crossed the line. But I am concerned about getting that line defined in a way that restricts project owners from making whatever changes they want in their own self-interest without tricking people, per se.