This topic came up when discussing the infamous left-pad disaster from awhile back. To give a brief summary the author of a small package hosted on the npm repository that numerous other packages had (indirect) dependencies on decided to remove his package in protest of the repositories policies. The result was that a significant number of highly important programs and packages all failed overnight when the dependency they all required could no longer be found.
We were wondering, purely hypothetically, could the developer have done something more malicious legally. Let's say, purely hypotehtically, that instead of removing the left-pad software he instead changed it so that it now did some bizzare or malicious behavior, like trying to remove everything from the computer (which the browser should prevent), or giving the wrong response 1/5 of the time (which would be allowed and would be much harder to trace the root issue to.
Assuming the individual fully documented the change and new behavior when he updated his source code then this package would still be doing exactly what it reported to do, and as such arguably anyone who downloaded the package would thus be choosing to run whatever bizzare apparently-malicious behavior he had added to the code. In reality the nature of how package dependencies work means that most people wouldn't know they had a dependency on the package, much less read the documentation to know that this package their unaware of now does something malicious.
Legally, if a develop tried something like this with a package would they be guilty of a crime? Or is it within the developers legal rights to change a package to do whatever he chooses, so long as documented, and thus fall under some 'buyer beware' clause where it's their fault they didn't realize the package had new functionality?
for now I'll narrow this down to focusing on US law, since I believe that's where the original author of the package lived.