This isn't like leftpad being deleted: he added an infinite-loop on purpose in a patch release to the package. This is a malicious attack. Only later did he delete packages.

Intentionally adding code that has an infinite loop (the for loop literally uses "Infinity" as the target for the 'for' loop) sounds like an attack to me..

Indeed, it's common nowadays to label things (ideas, people, etc.) in order to frame them in a way that's convenient to the labeler and helps him advance his agenda. I think given the global situation, some people become more sensitive to this kind of tactic (which is often used), while others have shown just how susceptible they are to it.

The author of the software didn't attack anything. He just pushed some code into a place he had legitimate control of.

Some irresponsible (see what I did?) developers downloaded and executed this code without checking, and as a result their stuff broke.

Yes I do strongly disagree with the wording (attack) here.

If publishing a package you control is considered an attack than the same could be said about the developer using the package or the admins deploying said package

It isn't an attack. He didn't do anything out of the range of his rights.

If it’s his project, as far as I’m concerned he’s within his rights deciding to make it do something different to what it did before, even if that is malicious. There is precedent for this with Chrome addon devs selling their addons to malware companies on the quiet.

That said, it is an attack on his users and it’s a shitty thing to do. He’s likely ended his career as an open source developer, and likely a paid developer as well.