Left-pad was un-published from NPM and broke builds using it. Serde-derive includes unreproducible and unoptional binaries, breaking many builds that prohibit s

Left-pad was un-published from NPM and broke builds using it. Serde-derive includes unreproducible and unoptional binaries, breaking many builds that prohibit such well trodden attack vectors. What's the difference? Trust is easy to destroy and hard to build. This is trust destroying behavior. There may be some positives that result from this but his reputation may not recover and his motivation for this behavior may not get implemented, it's more likely that cargo just gets updated to block this behavior (good for all of us, but not the intended outcome).