Isn’t calling this “malicious” a bit of a stretch?

It’s not like he is mining crypto on your machine. It’s a (however misguided) act of protest and demand for attention.

Fine GitHub put the breaks on in case it was an account takeover but they should allow him to do whatever he wants with his repos once it confirms it’s really him.

Also npm just removes his access…? If I was the author of a popular npm package and decided I wanted to remove it I’d hope npm and the “community” wouldn’t appropriate it and decide I don’t have an opinion about it.

Wanna clone it and upload your own? Fine. As the original author I should have the final say?

edit: undoing autocorrect