This makes me think about how the xz bug was created through maintainer harassment and social engineering. The security implications are interesting