35% of Log4j downloads are grabbing the vulnerable version

Begging the question of why the vulnerable version is still available to be grabbed in the first place?

this, companies who are hosting known vulnerable libraries should be charged criminally imo

That's one of the open questions. YES. Absolutely.

Deleting them would break builds ;)

35% of Log4j downloads are grabbing the vulnerable version (writing.gonze.com)