In short: author of Moq adds the dependency SponsorLink, which is an obfuscated closed source library that collects and uploads data from the developer's machine when the developer builds a project that includes a dependency on Moq. The collected data happens to be the hash of the globally configured git email address of the user at this point in time.

I simply cannot understand why someone, especially the author, would think this is a good idea. How can you not predict this will create a backlash and push users away?