Backdoor in event-stream library dependency
I really have a hard time putting as much blame on the author as the people in that Github thread are doing.  Maybe they could have handled this specific issue a little better, but the underlying problem is just one of the flaws in the open source community that everyone has to accept.  Maintaining a project is a lot of work (even just having your name attached to a dead project involves work) and the benefit from doing that work can be non-existent. If the original author has no use for the project anymore and someone offers to take it over from them, why should the author be expected to refuse?  Isn't adding another potentially unknown maintainer generally better for the community than a project dying?