I maintain a number of widely used open source projects. A number of years ago I received an email from an ethical hacker who (if memory serves) works for GitHu

I maintain a number of widely used open source projects. A number of years ago I received an email from an ethical hacker who (if memory serves) works for GitHub. He had identified that my 2FA was off and that my password had been leaked in a hack. He was able to prove to me that he was able to update the source of my projects and publish to npm. I was initially terrified and massively taken aback. I quickly 2FA-ed all the things and I remain very grateful for the report. Send the email. The MIA problem is tricky; if there's no maintainer (and you don't want to fork, fix and become a maintainer) then I'm not sure what you can do.