It was not advertised as a "working open source project". In fact, quite the opposite. From the license:
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
Its fitness for any particular purpose was expressly disclaimed, in all caps.
I'm not sure what people think they did wrong here. You're allowed (and should be allowed) to publish malware, it is up to consumers to not install software they don't want to run.
What more warning could they have possibly posted beyond this one?
If it is advertised as malware, yes. But if it is advertised as a working open source project - but in reality is malware, then this just destroys trust into open source in general.
I guess it is good, that these things come up, to think about why we trust the dependencies and repositories and their maintainers.
Because it seems, no we cannot just trust them. And now I am more conscious about it.
OSS should be about technology and not politics.