[jscheel]

Agreed, this is irresponsible.

[yourad_io]

There's warnings even in the description of the package:

    "name": "rimrafall",
    "version": "1.0.0",
    "description": "rm -rf /* # DO NOT INSTALL THIS",

How would you accidentally rm rf yourself with this?

A github issue "should" have sufficed, but it often doesn't. A practical demonstration is powerful enough to trigger immediate action.