“These social engineering attacks are exploiting the sense of duty that maintainers have with their project and community in order to manipulate them.”
After XZ, OpenJS got a run of emails from different names with overlapping GitHub addresses, all asking to become maintainers of a popular JavaScript project to fix unnamed “critical vulnerabilities.” It spotted the same pattern on two more projects outside its foundation. The playbook is guilt, urgency and sock puppets. The foundations call well-supported maintainers the primary defense, and then hand those same unpaid people a checklist.