Ask HN: How should I disclose this vulnerability?

I recently discovered a remotely exploitable shell command execution vulnerability in an open-source third-party add-on for a popular application. I don't know the specific popularity of the add-on, but I do know that it is recommended by other users of this app, and I found it by simply being a user thereof. It could be only a tiny handful of people affected; it could be thousands or even more. I simply don't know, and no stats are available.

I have contacted the author of the add-on who seems unwilling to fix the vulnerability. He or she has expressed a preference for simply removing the github repo. I have suggested that at least there should be a PSA in its place. I have also found at least one fork in the wild.

I'd welcome suggestions or references for how to proceed in a safe, legal and ethical manner. I have searched for current responsible disclosure guidelines but they seem focused on the professional vulnerability hunter and/or for major applications.