Given it was done with the intention of messing up other people's computers which the maintainer did not have legit access to - maybe its even a CFAA criminal hacking issue (ianal).
Anyways, there's a huge difference between accidentally doing something and doing something with the specific intention of hurting someone else. Sure you can disclaim responsibility for accidents & negligence, but i'm pretty sure you can't disclaim responsibility for intentionally malicious conduct in a contract, certainly you wouldn't be able to do so if it was criminal conduct (IANAL).
At the very least, Marak is an example of why we can't have nice things. None of us are obligated to applaud him for that.
One day, you show up and they have a sign up that says... No more free food, vote for Bernie. Are you really the type to complain that now you have to pay for food again or find someone else to give you free food, and throw a fit that their vote for Bernie sign is a trojan?
I guess the metaphor would be if you gave out free food all the time with a sign saying people aren't entitled to it, and then one day decided to add laxatives to it because you felt the people were ungrateful.
Which would land you in jail for a long time no matter what the sign said.
The person who put up the free food and the sign, after it was proven that they willfully poisoned the food (which is the only way I can interpret intentionally encoding an infinite loop in your testing library), would be liable for assault. You cannot just put up a sign that says "taker beware" to indemnify yourself from liability, especially after establishing the pattern that the food is safe.
If you ever wondered why grocery stores throw out perfectly good food (and sometimes padlock their dumpsters) rather than donate it to shelters, it's because this is how society works. They have to be clear that even food being thrown away is not intended to be free for the taking because if a pattern becomes established of people eating safe food out of a grocery store dumpster and one day that food is not safe, the grocery store can be held liable for injuries. Even if the grocery store never wanted anyone to use that food. The hard part would be proving the store intentionally poisoned it... But if that proof were made, the law is clear on who is responsible for the harm caused, and it's not the people eating out of the dumpster.
The underlying philosophical principle that underpins all of this legal precedent is "Don't intentionally cause harm." Marak broke that principle. Thank God Marak was only writing npm libraries and didn't own a grocery store.
This entire story, from the initial changes through the breakages through third parties intervening to mitigate their services being used to cause the breakages through other third parties stepping in to take responsibility to continue maintaining the code that had become vital, is one big open source community success story. The community interpreted intentional harm as damage and routed around it. And that was always one of the intended benefits of the open source approach, right? That the creator of the software can't ruin your day because they feel like it? Whether that creator is an evil corporation refusing to open their proprietary code, or a rogue actor deciding to take a sledgehammer to the pipeline... Open source mitigates the harm caused by both.
Link to even one report of Marak getting inside someone else's system.
> In computing, a Trojan horse is any malware that misleads users of its true intent. The term is derived from the Ancient Greek story of the deceptive Trojan Horse that led to the fall of the city of Troy.
> Trojans generally spread by some form of social engineering; for example, where a user is duped into executing an email attachment disguised to appear not suspicious (e.g., a routine form to be filled in), or by clicking on some fake advertisement on social media or anywhere else.
Marak disguised his malicious DoS attack as previously released useful software. I am completely baffled why people are defending his actions, at all. He could have easily just pulled down his repo, that would have been totally within his rights. Releasing malicious software under the guise of something else is not.
And the fact that people are quoting the license of "no implied warranty" is irrelevant. The law does not look kindly on those that act with malicious intent, regardless of what a license agreement says. For example, if he changed the repo to instead encrypt your hard drive, I guarantee he'd be going to jail. While thankful this was just a DoS attack and not something more serious, it was attack all the same.
Wikipedia doesn't define industry terms, especially in one-off throwaway lines without citations.
The Jargon File clearly defines a Trojan as something that (1) breaks your security and (2) is disguised as something benign.
http://www.catb.org/jargon/html/T/Trojan-horse.html
Unless you can show Marak Squires breached these folks security systems, it simply is not a Trojan.
(As a separate point, a claim that something distributed as source code is "disguised" simply cannot be in good faith.)
By claiming it is a Trojan, you are accusing Marak Squires of a potential felony by accessing a computer system without authorization. Making serious accusations like that should require some evidence. I don't see any.
A Trojan is where the attacker gains direct access to a protected system. It is a back door disguised as an innocuous file. The whole point of the Trojan Horse was the Greeks hiding inside of it to get into Troy.
Where is your evidence that Marak Squires gained access to any of the systems that downloaded and used his packages?
For example, one of the first trojans was: https://en.wikipedia.org/wiki/EGABTR