Github and the other code forges should do some automated scanning for this pattern. This is almost identical to the thread where the xv maintainer is pressured to bring on the attacker as a co-maintainer.