My own opinion on this: A developer updating their code & packages in whatever way they see fit is their right. Those folk downstream consuming these packages

My own opinion on this: A developer updating their code & packages in whatever way they see fit is their right. Those folk downstream consuming these packages are responsible for policing their supply chain with regard to security/quality/risk. That being said, this is a significantly anti-social move that will (quite rightly) negatively impact their reputation, and the trust placed in them, their code, and the packages derived from their code.