These days getting commit rights to inject malware into an already popular gem has become a real threat. In 2016 I think it wasn't yet/wasn't recognized. I am

These days getting commit rights to inject malware into an already popular gem has become a real threat. In 2016 I think it wasn't yet/wasn't recognized. I am very sympathetic to the suggestion in OP prior to recognizing that there may be people actually actively trying to abuse your trust to intentionally inject malware.