FWIW, I agree. I don't remember the name of the NPM module from the article I just read, and I sure wouldn't have paid them any money if I had been alerted as part of their experiment.

I only donate to obscure Debian derivatives though, so...