alt Hacker NewsThe target audience of this blog post does not give a damn about PyPI. The affected parties get literally nothing from this post. They already disclosed behind the scenes, that was the ethical part.
Writing PR pieces competing to be the most dangerous model around (so give us money!) is the unethical part.
You are right, they should never tell the public about failures in AI safety. They should have disclosed to the affected parties and then brushed it under the rug.
JFC there really is no satisfying the HN crowd.