Any reasonable expert in the field will tell you you don't plug an auto-updating dependency into production. Marak wrote code. You, (the consumer), pulled, and deployed it without due diligence. That is entirely on you.

Not one person is obligated to keep your crap working except you. This has really outed all the people who really should know better.