"@dominictarr Why was @right9ctrl given access to this repo?"
Response: "he emailed me and said he wanted to maintain the module, so I gave it to him. I don't get any thing from maintaining this module, and I don't even use it anymore, and havn't for years. note: I no longer have publish rights to this module on npm."
https://github.com/dominictarr/event-stream/issues/116#issue...
The takeaway seems to be that you should do a background check on anyone asking to become maintainer of your software.
With that said, this thing seems to have blown up because many large companies (Microsoft included) appear to use or depend upon this package. If none of these companies can lend 15 minutes of their engineers' time to help maintain the free software that they leverage, I can certainly understand the author's desire to let the module's maintenance become someone else's problem.
I think many maintainers would have done the same.
I for sure miss old times when I got .Net framework, maybe some library from 1 or 2 3rd party vendors and I had all I needed for development.
Of course in this case this is made worse by the fact that Javascript is so under-featured by default that you have to pull a ridiculous amount of dependencies to do anything which makes it a lot harder to audit everything. Besides since the language is so dynamic it's easy to write a very small, very powerful "shellcode" that can hook itself up anywhere in the software stack.