Of all the awful legal takes I've seen on this site, yours is an early contender for best of 2022.

> No warranty means he isn't liable for any behavior of the software at all.

Somebody should tell all those computer virus authors, all they had to do was not include a warranty, and they're untouchable!

You can pretend there's no difference between this and a computer virus, but there clearly is.

The users of this software pull it, explicitly, voluntarily. The author says it doesn't serve any particular purpose, and in using it you understand that. the software itself did nothing malicious, it just stopped working. It's not the same thing as slapping a license on a computer virus and forcibly foisting it onto an unwitting victim. It's not naive legalese loophole workaround thinking. When you choose to use the software you agree to abide by the license, which includes no promise of utility whatsoever.

Those seem like different things since a computer virus "user" never consents to or accepts the license, whereas someone importing the library into their package.json has.

Eh, just write in the EULA exactly what your virus will do and that they have no warranty, bundle it as an add-on a la toolbar bundling in the 00s, and bam, you've got the user's consent to do anything!

He is responsible for his own behavior, and harming with intent is not a liability that can be waived in the US. This is literally first week of Contracts course material in law school.

But there was no harm or no intent to harm, the software just stopped working. Just because you rely on someone's work doesn't mean you can expect it to continue forever.

no it does not mean you can legally change your software to malware.

I think it's disingenuous to label it as "malware".

Nah its not. It crashes hoobs and the ring plugin for homebridge. And probably a lot of other software.

Modern JS crashes my older browsers too. It doesn't mean it's the JS author's fault for using code my system can't handle.

The intent is extremely important to the word malware. the intent WAS malicious.

It was malicious about as much as flash no longer working, or nest thermostats.