The point is that this is not just a problem of Hacktoberfest - there are some automatic quality assurance tools that check if libraries used in project does no

The point is that this is not just a problem of Hacktoberfest - there are some automatic quality assurance tools that check if libraries used in project does not have bugs and they do this also by searching GitHub for reported bugs. If there is a reported and unfixed bug, library is marked as not safe. It happened several times that there was a reported bug, which was totally bogus or added by mistake (added to wrong project for instance), however repo owner hasn't closed it, so the tool gave false positive. Obviously said tool allowed adding exception rules, etc. but I can't imagine how annoying it would be if there were hundreds of such crappy reports and it seems we are going in that direction. This looks like another consequence of globalization and leaving in the "global village", everyone can jump in into someones village and do harm over there and it is hard to get rid or somehow punish such unwanted visitors. People would do a lot to gain 15 minutes of fame, even if this is just wearing some t-shirt. Maybe that is not a big surprise, some people beat their parents or girlfriends or boyfriends and put that on Youtube for fame and money - whole "pato" streamers market is built around this (with said victims participating in the show to earn even more money).