> It is just as likely that the original author will turn malicious it absolutely isn't. The original author is a real person, with a twitter account, with a p

> It is just as likely that the original author will turn malicious it absolutely isn't. The original author is a real person, with a twitter account, with a profile photo, with videos of talking at conferences. I accepted the code in my project because such author wouldn't get away with injecting the code with a backdoor. But a random alias that quietly takes over a package I didn't even know was abandoned because the author was too lazy to write "This package is no longer maintained" in the readme? That didn't give me any chance...