Indeed, the author of this package is not at fault here. It is the responsibility of the users depending on this package to check in all their dependencies and ensure to have reproducible builds.
I think many maintainers would have done the same.
That is just not realistic for most people. Maybe big corps can make that, but even basic things seems to download hundreds of megabytes of dependencies and I could just read for months before I would even start to develop.
I for sure miss old times when I got .Net framework, maybe some library from 1 or 2 3rd party vendors and I had all I needed for development.
If you're developing something dealing with sensitive info (like, say, something processing cryptocurrencies) and you can't audit your codebase then you shouldn't be doing it in the first place frankly.
Of course in this case this is made worse by the fact that Javascript is so under-featured by default that you have to pull a ridiculous amount of dependencies to do anything which makes it a lot harder to audit everything. Besides since the language is so dynamic it's easy to write a very small, very powerful "shellcode" that can hook itself up anywhere in the software stack.
While there's plenty of blame to go around, I have a gut feeling this isn't the last time we'll see something like this. A little malicious social engineering is all it takes to affect millions of people, apparently.
I think many maintainers would have done the same.