Is that any different from someone offering to buy a browser extension to add malware?

Yeah, if they don’t add malware. I doubt redis will add malware to specifically their rust client.

OSS authors can add malware too.

the library would most likely remain OSS even after the take over