You'd probably be most successful modifying the original repo - either by being the creator of the software or gaining their trust. However, it would have to be

You'd probably be most successful modifying the original repo - either by being the creator of the software or gaining their trust. However, it would have to be a rather powerful SHA1 attack for the commit to still be valid syntax, hard to detect, and make a meaningful malicious change.