It wasn't yanked, it was fully removed.

They did that because a yanked package can still be used. And in this case there weren't any downloads, so it is unlikely the malicious package was actually used.

Call it how you want, the point is that it should not disappear like this. Maybe yanked has the meaning you said, but in Ruby yanked has the meaning OP said and that is what we want.

How to call it then : Yanked hard vs yanked soft ?