I desperately want you to be right on points 1, 2 and 3 (there's no disputing 4, and in addition this is a great example of why keeping/maintaining package-lock.json with your project(s) is so important), but with as much virtue signaling and pure anti-Russian hatred that's going on worldwide right now, I genuinely worry that this faggot is going to not only get away with it, but will actually be celebrated for it.
Bear in mind he's in California, which is overrun by woke cancer at this point. There's enough dipshits in positions of authority at companies with more money than brains who will cheerfully hire this asshole because he pulled this stunt because "muh Russia bad."
There's enough woke contamination within the federal agencies nowadays that it's probably 50/50 odds whether anyone will even make an official attempt to get a case off the ground, and even if that happens there's plenty of woke glowies willing to torpedo any such effort from within anyway.
And sadly I doubt Russia or Ukraine have the pull or inclination to influence the US government about this either. Russia (for obvious reasons) won't get anywhere with a complaint (the US will laugh in their face) and Ukraine is our whipping boy, not the other way 'round. And they're both pretty distracted with other affairs at the moment anyway.
Who knows, though? Maybe we'll get lucky and they'll nail this prick to the wall. I'd love to see some actual justice done for once.