I regard that as an attack, specifically a denial of service. Whether he had the right to do so doesn't matter much, he voluntarily broke other people's apps.

I regard that as an attack, specifically a denial of service. Whether he had the right to do so doesn't matter much, he voluntarily broke other people's apps. Btw, I'd say that he for sure has the right to write purposely broken code, but probably not to push it on npm (it depends on npm TOS, though). If it was for me, I would just suspend his npm account and keep distributing the existent code, since the license allows to do so.