5. He had to rename the repo for legal reasons.
He clicked rename on the wrong GitHub account.
30 seconds later, someone sniped his old account and pushed malware.
Then they sniped his NPM package. Then his domain.
His words: "I was close to crying."