1.It is totally in his prerogative to mess up the package he manages, but not to install into it malware. I am on the fence if this would count as malware. (Because of the open loop, but my leaning is that this is not malware.)
2. Github is, IMO, breaking any trust that I might have had by assuming control of the package, removing the last commit and keeping it online.
If they feel they have a reason to close it, they should. And, they then should fork it and put it up under their own name. Which would generate lots of bad press, but is at least within their rights.
3. I don't quite follow the logic of Github closing his account. Yes, I know that when you use $megacorp they WILL eventually close your account and make you sad. Google did it to me once and shut my gmail account. Tough luck for not being a millionaire.
4. You should always lock your NPM dependencies on a version, and update it when you can see what the results are.
5. Yes, the large corps really should be paying for all the work that is being done to help them, despite their hostile attitudes (being typed on a Mac. Guess who wrote the docs? Not Apple.)
6. Github has some perfectly good competitors, both SaaS (gitlab.com, sourcehut.org) and self-hosted (gitlab, gogs/gitea, etc)
Using them empowers you, and removes a wincy bit of leverage from $megacorp. Enough people follow suit, and the world will be a better place. And besides, Copilot won't steal or reveal your code.
7. There are more effective ways of making his point, but he worked out of emotion, not logic.
Eg. Perhaps he would have been able to change the license and demand compensation from all non-profits? That would provide both cash and publicity.
As a rule, it is always better to act out of logic than emotion, but us humans seem to have an issue with this. ;)
8. Is anyone stepping in to help the author get treatment?