Comment by stickfigure

There is a social contract in the world of open source. The author violated it.

If he exploited trust to steal private crypto keys, we'd have no trouble calling it an attack. The difference is merely a matter of degree.