The counter-framing is this guy updated his project and thousands of projects chose to pull that update. He didn't go around submitting PRs to update the versi

The counter-framing is this guy updated his project and thousands of projects chose to pull that update. He didn't go around submitting PRs to update the version of this. He didn't deploy anything into production. You have the right to use the code for free, and he has the right to do terrible things with his code. If you don't like that arrangement, get him to sign a contract that includes responsibilities on his part like not shipping intentionally broken packages. Or get your distribution from someone that does have a responsibility to you. I probably wouldn't do the same in his position, but I still support his (moral) right to do what he did. It's his project, and he can tank it if he wants to. Just like if I had a business, I could tank it if I wanted to. It's probably not a wise thing to do, but it is something I could do.