The fork with malware embedded could fairly easily apply most commits to the main repo in its public repo. They could even have support pages that look real, b

The fork with malware embedded could fairly easily apply most commits to the main repo in its public repo. They could even have support pages that look real, by copying them from the legitimate site. And the process of creating a repo that stays in sync with another fork can be automated, so, if needed, malware writers likely will do that.