> Developers are users too.
But most users are not developers, and "developer" is the relevant category here, not "user". So saying "user" is inaccurate.
> They did an act of “npm install gratis shit”, and they don’t give a shit where that code comes from. I.e. blindly trusting code from the internet.
I'm not unsympathetic to this. However, even if other developers were at fault, that doesn't mean Dominic wasn't. Not deprecating the package, and not telling anyone when he handed over the publish rights to a random person who emailed him, is still wrong even if the developers who used his package were wrong as well.
False dichotomy. Developers are users too.
And trusting random code from the internet is still irresponsible as a developer, maybe even particularly as a developer.
> Developers aren't trusting random code from the internet; they're trusting a particular package
Let’s be honest. They did an act of “npm install gratis shit”, and they don’t give a shit where that code comes from. I.e. blindly trusting code from the internet.
If they expect more without getting involved, they are by definition acting entitled.