Once upon a time I had great faith in the .org plugin directory. Simple quality plugins.

I thought i'd come around to auto-updates too. But for .org plugins like this it's just way too high risk.

I've seen some really good plugin adoptions/takeovers over the years. I've seen some unnecessary failures (Postman SMTP for example).

Then I've seen things like this that someone should have stopped.

If the .org directory is going to remain a trustworthy source then stuff like this needs to be addressed.

Just some thoughts. Perhaps anytime a plugin adds a new developer there should clear notification in the dashboard and auto-updates shouldn't occur until that notice has been cleared.