German law is if anything stronger on this point. A maintainer intentionally shipping malware-like behaviour in their project is definitely Vorsatz oder grobe Fahrlässigkeit