Arguably he did people a service by reminding relying parties of this vulnerability. Both that upstreams might pull their repos, and that upstreams might incompetently run their distribution infrastructure (all the npm issues...)