The OPs excuse of "I'm not being paid, If it's not fun anymore, you get literally nothing from maintaining a popular package."

Really? You create a package for fun, OK that's totally fine.

But now you publish it, and millions of people use it.

But because you're not being paid, and because it's not longer "fun", you think it's totally acceptable to hand it off to some random Japanese Github account with no projects?

Why does being paid matter? There are millions upon millions of gratis (free, not as in freedom) projects that developers create.

How would you like if your free github, reddit, facebook etc.. account was compromised and your personal information lost, or w/e.

And the dumb as fuck excuse is "Well you don't PAY me, why would I do something UNFUN if I'm not PAID" is what you're given.

How childish can you be?

Was it a naive mistake? Yes. Can we move on? Sure.

But it was still an irresponsible mistake from a Security Expert, and a completely unacceptable lame excuse that it doesn't matter millions of projects were probably compromised because it wasn't "fun" or it wasn't "paid for".

Sounds exactly like those companies that leak oil into the water, or bulldoze irreplaceable rainforest because money always trumps social responsibility and being a decent person.