[oefrha]

> They can try but they largely will not succeed

Whether they succeed or not, it this takes off it creates a big incentive towards adding your own crap dependency to successful projects, that is to say, more garbage PRs (some better disguised than others). It’s like the Hacktoberfest disaster. The only difference is this has a tangible upside, the question is whether is outweighs the downside (quite likely in the taking off scenario), whereas Hacktoberfest is strictly negative value-add in my experience.

[nevernude]

There is another, opposite incentive at play which is to reduce the number of dependencies you have so that you receive more funding.