Comment by thayne

It wasn't yanked, it was fully removed.

They did that because a yanked package can still be used. And in this case there weren't any downloads, so it is unlikely the malicious package was actually used.