I think "attack" still best describes the move even if it was an indirect attack (ie he poisoned his own code then others ran it). The intention was to create a denial of service "bug" as a protest and given it was deliberate I don't think the term "bug" is sufficient. But you're right it wasn't a direct attack and I'm inclined to also agree that it wasn't intended to be malicious (though not all attacks are).

> In fact, I also take issue with GitHub / Microsoft taking over the package and am very worried about the precedent that sets, regardless if their motives this time appear to be entirely selfless.

Yeah, I agree with you here.