Comment by spankalee

Just because the package owner had implicit permission to run code on other people's machines, doesn't mean that this wasn't an attack.

A postal carrier may have a key to a building to deliver mail, but if they use it to turn on all the faucets and leave the doors open, it's an attack.