Since v4.20, Moq is harvesting email addresses

As has been pointed out. It is not sending the email address as plaintext, but it is sending a hash of that email address. Unfortunately this is almost as bad, is not enough to prevent the actual email address being identified - de-anonymisation is feasible in a constrained search space such as "standard email address formats such as first.last@company.com".

It is not GDPR compliant:

> Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.

https://www.privacy-regulation.eu/en/recital-26-GDPR.htm

Then there's a "known unknown" of running some closed source, obfuscated binary on your build server. The SolarwWinds supply-chain hack got in via TeamCity so this is a Hard No from a security point of view.

> it can't be trusted anymore

We're going to wait and see and not apply the Moq 4.20 update. In a week the picture should be clearer. But today it looks like it's going up in flames. This is sad to see, there could have been other ways to keep everyone happy. There should be a way to accommodate the Moq dev who did something remarkable as OSS, and wants to pay the rent thereby; without this drama.