Or, you know, I’ll never touch Vue.js again?
Could be. But by whom? To what effect?
One of the downsides of losing credibility as a nation state is the concepts of deference, retaliation and proportionality lose weight. There is no indication that the facts on the ground would affect whether Putin deems something a cyber attack. Worse, one's own policing actions are likely to cause more damage as propaganda pieces than ignoring the issue.
Yes, in an international law framework this would be prosecuted in the U.S. But in that framework Russia wouldn't be in Ukraine. Add to that it's tacit approval of its own hackers, and it's difficult--in a realpolitik frame--to find support for doing anything about this other than minor finger wagging.
The general public. I speculate that publicity was one of the main objectives behind this operation to draw attention to his political grievances and maybe demands.
Perhaps we should focus more on the issue of bragging rights. The perpetrator probably thinks he's some kind of a hero having conducted this operation and it was some kind of a heroic feat sticking up to Putin when he in fact is more of a lousy vandal destroying some poor guy's store window than an epic warrior conquering foreign lands and subduing evil emperors.
The more people realize this and esp. people who are prone to commit these acts, the more innocent people would be spared the damage incurred by those reckless attacks.
Weaponizing open source is such an awful precedent. There are extremist groups of every shade who harbor ill intent towards some other group or institution. For a rather mundane example: "My malicious npm module detects you are running the Brave browser? The evil Brendan Eich runs that, say goodbye to your filesystem!" Never mind if you are part of a group that is mired in controversy, chief among them at this time being Russian.
And in this case the 'horrible act' is not wanting your free labour to be used in another country.