Yes I do strongly disagree with the wording (attack) here.

If publishing a package you control is considered an attack than the same could be said about the developer using the package or the admins deploying said package