[peteradio]

He could sell rights to the repos and disavow any knowledge of its maintenance while maintaining the link in his own repos. When those sold rights are used to commit some crime he has plausible deniability as anyone else but got a payday. If you try spinning off the subpackage just prior to a sale then it shows some sort of intent.

[umanwizard]

Is there any evidence that he has ever done anything like this, or that he plans to? Or is this just pure speculation?

[peteradio]

I didn't declare he's done this only that it is a vulnerability of depending on those packages.